dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:08

Target

dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
Size

1.6MB
MD5

6fa5e5ec590c36cd98894157c3b35b4f
SHA1

4b905a9938cb4519a419c156984789244b5784a4
SHA256

dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738
SHA512

fb2f4aeded53c50c8f47296ce14df05d2c9f753b8eceeff19cbbe97b4bc4c132b4fd06798319e657a64094d396d4f02c1dcb2db12c2b15602aa941fb21c2027b
SSDEEP

24576:xzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY:D6/ye0PIphrp9Zuvjqa0Uid

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
944	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
944	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
944	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
944	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
944	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80
PID 1700 wrote to memory of 944	1700	dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe	80

C:\Users\Admin\AppData\Local\Temp\dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
"C:\Users\Admin\AppData\Local\Temp\dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe
  "C:\Users\Admin\AppData\Local\Temp\dd247b12809af05f24caec9892225fe5f2b8081ff9f6d98baadc11c3ccf00738.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:944

memory/944-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/944-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/944-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/944-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/944-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download