db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25

Analysis

max time kernel
174s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:21

Target

db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
Size

1.3MB
MD5

8ecd8a54622d5e31628cad464d79918d
SHA1

128c2eb4bb627f9c98d8fc00a30364839325c6f0
SHA256

db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25
SHA512

54bd81f5278c347f7f234035be1c10361eba9fef82a56f13d88f978e74df9827e0d3560bb0107ab52984ec399b62d7651ab7922675be8b6802fc0b5674662571
SSDEEP

24576:vKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcut:vKVzMNuwIKyoBmnMSURNQN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3028	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
3028	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
3028	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
3028	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
3028	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83
PID 3900 wrote to memory of 3028	3900	db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe	83

C:\Users\Admin\AppData\Local\Temp\db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
"C:\Users\Admin\AppData\Local\Temp\db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\db3fdda44d106afacd06eb57d8041fa6fc4dc6c462b66649662ca7184e877e25.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3028

memory/3028-132-0x0000000000000000-mapping.dmp

Download
memory/3028-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3028-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3028-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3028-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3028-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download