d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:56

Target

d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe
Size

1.6MB
MD5

566b2d5442c835ddaf80f215f5ef1a64
SHA1

8f1b2bc0a9fa4985909e9719b15963f3b849b314
SHA256

d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c
SHA512

f9b63d0dfa1fdf611ede38bda1c9778553fb129f171e82af03ffe97e7ef6283a29b902e22fb23e54b8226bdd654dd5436368478261c39e141c983a74da6c47c0
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYS:X6/ye0PIphrp9Zuvjqa0UidR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76
PID 3372 wrote to memory of 4952	3372	d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe	76

C:\Users\Admin\AppData\Local\Temp\d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe
"C:\Users\Admin\AppData\Local\Temp\d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe
  "C:\Users\Admin\AppData\Local\Temp\d40c260e031119d6fb81549135fb6852b94221d81069a706b245534324b9dd1c.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4952

memory/4952-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download