6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:17

Target

6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
Size

1.2MB
MD5

3e7c81b7a3ecef01c2809e5a3f3baf26
SHA1

9059daca5b37ee36eeb2fc53f0df2207b84d92e7
SHA256

6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14
SHA512

1eabc85b8130c7fdacf91d657673fd1052f1df10724c0bb6de3c48490318371b69548c8ade00d99d78a42efd1ffe6a0a5dba23d7df238a12610eb1eb8791b9bc
SSDEEP

24576:ECe9Oe9v9mKihqDftePGtlD75o1sfsNP0G3jXpaIl:EHO2v9mKihE6QDdMkOFaS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4556	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
4556	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
4556	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
4556	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
4556	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84
PID 4940 wrote to memory of 4556	4940	6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe	84

C:\Users\Admin\AppData\Local\Temp\6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
"C:\Users\Admin\AppData\Local\Temp\6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\6d8a535666b3f7c17fef8c7e14cf1d7378d18eef044a938db127897c54c02f14.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4556

memory/4556-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4556-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4556-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4556-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4556-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download