72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 10:54

Target

72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
Size

1.3MB
MD5

bd6dec672a345fd24616a6453b6429c5
SHA1

a31e5471437eb46fbc6d5037bfd10addb13baa25
SHA256

72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e
SHA512

f07d26bf177206e530bb5436d9ad5eb4cace4d59d9f914dfee7e3a58654f14337a0733c6d9e4c5ff4740e8b9711b1c56050e7e01022a2318a0cbedc8a8f9f7e0
SSDEEP

24576:4OiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9A:Ri1DWLFP53UGe76x0ZUphdtn

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1996	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
1996	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
1996	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
1996	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
1996	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80
PID 4728 wrote to memory of 1996	4728	72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe	80

C:\Users\Admin\AppData\Local\Temp\72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
"C:\Users\Admin\AppData\Local\Temp\72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\72cd1a79a3b8f3d1f17f50489b49d600ed9cc65daf0a8287b24ba5266f49cc1e.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1996

memory/1996-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1996-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1996-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1996-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1996-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download