d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 11:57

Target

d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe
Size

1.3MB
MD5

6f5193b83a865f23da1eafa5e1f0aaba
SHA1

d4f31ef431127063352a9cc65a61aa79054d11dc
SHA256

d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259
SHA512

35e55cf342c53d4c7301af83600adb79efe6399fbc20d234da9b1ab26496831f1006cc2038f896133e63bcae7f62e33be82172ace10c5ab9223cc3c858a51b1c
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak5:zrKo4ZwCOnYjVmJPai

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79
PID 2416 wrote to memory of 4348	2416	d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe	79

C:\Users\Admin\AppData\Local\Temp\d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe
"C:\Users\Admin\AppData\Local\Temp\d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\d3ed836614797df662820b4d42d26f387e73373897f9015bfd997f7a3de66259.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4348

memory/4348-132-0x0000000000000000-mapping.dmp

Download
memory/4348-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4348-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4348-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4348-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4348-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download