d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 05:11

Target

d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
Size

1.3MB
MD5

1f9d75400779c905da0e4ee69953db7b
SHA1

6be6b9e32c15a5573395d24f657d03f62db26007
SHA256

d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53
SHA512

4928b910fb9e0d73778cd3ff5ac624bedc690770e77e038419e17d030ab7c46f172fbc088a6d5f78d45fa9bd11a37d152f563fc958ac7cf40409c7caebfa8af9
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakF:7rKo4ZwCOnYjVmJPay

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2300	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2300	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2300	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2300	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2300	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80
PID 1848 wrote to memory of 2300	1848	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	80

C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
"C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2300

memory/2300-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2300-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2300-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2300-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2300-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download