1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 02:44

Target

1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
Size

1.4MB
MD5

0280fc6a55788bb177eeccff01a6a134
SHA1

d5a9d2af58b4465bf1aceba176d364db891f6871
SHA256

1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd
SHA512

9d93d3dfe5ddbb0ac059571f12990d89139b26a90c7efa4356d99bc2d58fdb088a85e61054a8f4b2df5964f397354c7537e7cafef50d7c3037c7dfac71617ee7
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aw:hrBew72604doSw6ewf

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3700 set thread context of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3960	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
3960	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
3960	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
3960	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
3960	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79
PID 3700 wrote to memory of 3960	3700	1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe	79

C:\Users\Admin\AppData\Local\Temp\1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
"C:\Users\Admin\AppData\Local\Temp\1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\1ddc82e682142d6bcb2425e7999ec00f19dd3d02206610a03c8a27b3655f94dd.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3960

memory/3960-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3960-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download