d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 07:20

Target

d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe
Size

592KB
MD5

bc78c4efab2d317025a2cbd3a12f7004
SHA1

1b1931bc6ee0b1d66bc28c93682d50766384bee2
SHA256

d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66
SHA512

db8648abf0a3d8ecf4ded3c37f687ee22540653fa10eb27622aaa0304308014294d7b36d4bcbd67ae59caeeb310159ae178be90024992eac93e665fee288b60d
SSDEEP

3072:Poe42hfwWsDmjLf59Crner4kUIPQqVI6arFBokKteMNMQDkMxzVA0g5DPfr/M07d:PVJvK75DPz/M076APTKYc5s

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4376 set thread context of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84
PID 4376 wrote to memory of 1872	4376	d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe	84

C:\Users\Admin\AppData\Local\Temp\d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe
"C:\Users\Admin\AppData\Local\Temp\d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe
  C:\Users\Admin\AppData\Local\Temp\d4893ae5ce2adc3d140d9da7bfa6f65274340ed45bdd9c48fca7cc088b1e8a66.exe
  2⤵
  PID:1872

memory/1872-136-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1872-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download