1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf

Analysis

max time kernel
318s
max time network
343s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:28

Target

1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
Size

1.3MB
MD5

6ce5b301e176f0ab3d13a2f1ed279643
SHA1

0e0578d68bbbded302f17b1b57bc61af01e38ba8
SHA256

1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf
SHA512

c08cbddfe8c8da8776cc638cb67e97738e8c6716c3e63446c0d3a22802f56b75a5f0b037f4bca604e2b6c0e699a90700a5efc31e57c0d2352d2ec7592e044b92
SSDEEP

24576:vKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcus:vKVzMNuwIKyoBmnMSURNQM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4492	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
4492	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
4492	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
4492	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
4492	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82
PID 224 wrote to memory of 4492	224	1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe	82

C:\Users\Admin\AppData\Local\Temp\1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
"C:\Users\Admin\AppData\Local\Temp\1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\1ff0d3cfedaa85a9d38af4b091699fd43c3e067d44bf3d069678a6143ab0fdcf.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4492

memory/4492-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4492-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4492-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4492-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4492-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download