04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54

Analysis

max time kernel
103s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:29

Target

04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
Size

1.0MB
MD5

147c0779e269d0e775c0c7439dfd534a
SHA1

9ee3c64b7c161364ed703cf1c804a4baca56e9f9
SHA256

04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54
SHA512

1a41eb2d77fe843c9f516acd584b28275b078367a883146c9702a38f3ddf5d43cece3da478c743b2987cab3507182c429355cac1be79bee8a510c6ea1f959e8a
SSDEEP

24576:4J0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpN:4WFPaXGalaCTt8XjwoGji8q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3348 set thread context of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1708	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
1708	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
1708	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
1708	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
1708	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80
PID 3348 wrote to memory of 1708	3348	04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe	80

C:\Users\Admin\AppData\Local\Temp\04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
"C:\Users\Admin\AppData\Local\Temp\04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\04dc0930da85c2e79b1e9e01142e5cfb3ce3d9e0c97f44515f16bc38a0355f54.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1708

memory/1708-132-0x0000000000000000-mapping.dmp

Download
memory/1708-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1708-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1708-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1708-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1708-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download