2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 17:54

Target

2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
Size

1.2MB
MD5

707f4f3297fa8d944fc2efa632176976
SHA1

838d70b079278760916149731e8ae58eac8836ba
SHA256

2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93
SHA512

d895d126944b8f58e074f9eb2bd4eef0e5fc7da272688dc5f6a00bbfb4f89e76ca544d46b7cd2157e66b403b7d582b8ecf5b5b51722963b759469a8a5e80157c
SSDEEP

24576:JbkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42C6:+qvCEaRkca2Yb/3PmKxqL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1964	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
1964	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
1964	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
1964	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
1964	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83
PID 1200 wrote to memory of 1964	1200	2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe	83

C:\Users\Admin\AppData\Local\Temp\2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
"C:\Users\Admin\AppData\Local\Temp\2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\2d8979586b957e6dc0e240adcdd8b3a5395a38cecd71ba2fcab620498ba9ae93.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1964

memory/1964-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1964-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1964-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1964-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1964-137-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download