d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e

Analysis

max time kernel
194s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:24

Target

d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe
Size

53KB
MD5

639a141d32ee9b97aa1bda6190b2ac60
SHA1

c3dea2ea40290a9b6724ccda60ab281be9cdf671
SHA256

d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e
SHA512

e5fa30938179e06ffec26868da001531b1a01ce4a366cf9d65b9b9a4798531fa9a2ff4bd97a51afba0981b6ae74ae349d06631772ec5d78ecf222065a5ecd39b
SSDEEP

768:bdzgosBo5hNZ1tYF3UCJGrXg16DHAw/j3KN:Zz5jZ1tYCC0rXXDgw/2N

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3404 set thread context of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81
PID 3404 wrote to memory of 4352	3404	d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe	81

C:\Users\Admin\AppData\Local\Temp\d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe
"C:\Users\Admin\AppData\Local\Temp\d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe
  "C:\Users\Admin\AppData\Local\Temp\d6c3eb7e8352daa66b475dc0765eb1ed67e843bda938bbfe41bb1b53a758c91e.exe"
  2⤵
  PID:4352

memory/3404-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3404-139-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4352-136-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4352-138-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4352-140-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download