cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 21:12

Target

cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
Size

1.4MB
MD5

adb79b47bcf2ddfebf04f58e5eb7cbc9
SHA1

2339f71bca539fe6840a37d9f0be3710ddd40966
SHA256

cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e
SHA512

ed9ecc2cb9e9fcc2aca1b5d62f0c8cdca71db390e446275a9e6b43969a7bcb63bca7f5b05803c604879bbb9b26b518964eae881934cd5c3e2dfe882b85b0673b
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8At:hrBew72604doSw6ewW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3376	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
3376	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
3376	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
3376	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
3376	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80
PID 2148 wrote to memory of 3376	2148	cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe	80

C:\Users\Admin\AppData\Local\Temp\cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
"C:\Users\Admin\AppData\Local\Temp\cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\cd895422bcac59c98b72b6ccc4dc5dce1a75adc5a6bba36bda50f042d2ec842e.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3376

memory/3376-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3376-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3376-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3376-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3376-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download