7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 13:47

Target

7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe
Size

392KB
MD5

2edf119b5ad2b5193c8911911950efe3
SHA1

bd5efd3d65701e14a127c0fa6a4dfe76af0ef67d
SHA256

7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78
SHA512

dbc38abf14661c7f622f6d9689c90ac27226e0bb3753ace56993ba2f0aa76bc18ad695ebd8b1f6900c60f4e473c936f2d1645b18b3f57e36f49992bb11853d05
SSDEEP

6144:kFRQw1oS6ndDOJ9uPQx4pMwHvKRHUVsMgpDqmO0oTKvYFzSgAcmeUFGnkPGjTPmm:26KxjW0DDxEgoOZq2rkgMYuX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4932 set thread context of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84
PID 4932 wrote to memory of 1540	4932	7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe	84

C:\Users\Admin\AppData\Local\Temp\7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe
"C:\Users\Admin\AppData\Local\Temp\7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe
  C:\Users\Admin\AppData\Local\Temp\7de2ad591d7b548bbb9c9e9d2ca3b6491425731a3300387a2ff9a58e0a035f78.exe
  2⤵
  PID:1540

memory/1540-134-0x0000000000000000-mapping.dmp

Download
memory/1540-135-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1540-137-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1540-138-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1540-139-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download