dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5

Analysis

max time kernel
155s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:22

Target

dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe
Size

1.3MB
MD5

c3956655b5b2596d51ecf4794bedd193
SHA1

22fb264f6da4279fc5a1dba4b5384791dc97fc02
SHA256

dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5
SHA512

df622f93da685c70395185d2c86b693a707e9cabb76893476f436bb8525939665f2b90f1ddd80610d9a6a0058f34e30292c290f1374a10a816d5a13c597c022e
SSDEEP

24576:TGjJZtAXaMb5YpCCNAfGU64giomYhXlZwVBhVS+JbIHICWKotTn+WW:TGNZpbmfLRgioDXz+BhA3SvVndW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79
PID 4012 wrote to memory of 4716	4012	dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe	79

C:\Users\Admin\AppData\Local\Temp\dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe
"C:\Users\Admin\AppData\Local\Temp\dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\dd7739f1b14c6bd772d37632949b4e163216834e1409b857b4e8726c0ca203b5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4716

memory/4716-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4716-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4716-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4716-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4716-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download