b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:22

Target

b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
Size

1.3MB
MD5

e423f49904e6fafc5c4cad5e90ded165
SHA1

dbd9d7b46cd8955df6960a255bb57b183a5b1645
SHA256

b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f
SHA512

8e757c0571bb2e7a88d23c4b220096edc20f73c58eb7f8663e959962cc89ee3572441535968f65b92176135a774f0f51f91f1c0715f452f8ccf2a9be36480cb1
SSDEEP

24576:2KyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcu/G:2KVzMNuwIKyoBmnMSURNQfG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1940	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
1940	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
1940	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
1940	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
1940	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81
PID 1312 wrote to memory of 1940	1312	b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe	81

C:\Users\Admin\AppData\Local\Temp\b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
"C:\Users\Admin\AppData\Local\Temp\b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\b6ddb4c0827da5ca417858b1aa88a8e62bcb0d68c9b835924becad277679538f.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1940

memory/1940-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1940-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1940-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1940-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1940-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download