c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 04:46

Target

c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe
Size

108KB
MD5

c278be9b8b7f3f0548076071673e5a60
SHA1

e3ad15ca43a4500469d4bc995ef858e3582e0ade
SHA256

c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d
SHA512

b119c911388907d682ac746572fade14412728cdb9422c3024f071057aea038f1cec3c50fccd9fc6aaf4cba2e8049e9adc8194bed7b8677ab8d646e991c01783
SSDEEP

1536:9Q/9Y0AgK+lptFpui7jcnMGbe7AG+Xh2FeE710:6/9Y9YptKi7jATK7AG+xee

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79
PID 4444 wrote to memory of 2368	4444	c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe	79

C:\Users\Admin\AppData\Local\Temp\c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe
"C:\Users\Admin\AppData\Local\Temp\c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe
  "C:\Users\Admin\AppData\Local\Temp\c71ee156114ec98a6366c0941072e6d39e3e9a2d0950f342a6c8a98f5bf8ed1d.exe"
  2⤵
  PID:2368

memory/2368-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download