d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:57 UTC

Target

d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
Size

1.0MB
MD5

bd520d654c89503dbe960afc781ceb75
SHA1

325792880b5d211606842c11840878d018f6686e
SHA256

d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b
SHA512

260978d72ea11224ad31f9ca5eca9bf6f742ba9f94bfb7ea1404fe63bec441542cae473bf72e286bb6adad3a081256a13d6f190c56b09f13733a52c7757e6e1f
SSDEEP

24576:/J0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpC:/WFPaXGalaCTt8XjwoGji8F

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1872	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
1872	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
1872	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
1872	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
1872	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80
PID 4460 wrote to memory of 1872	4460	d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe	80

C:\Users\Admin\AppData\Local\Temp\d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
"C:\Users\Admin\AppData\Local\Temp\d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\d218ed1e005cfb06cc7bdd22cefa934fc279c562dc502ab18d206101ed7aa51b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1872

memory/1872-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1872-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1872-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1872-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1872-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1872-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download