d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f

Analysis

max time kernel
204s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:59

Target

d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe
Size

1.3MB
MD5

aa724a8b8ef362d1da227182893c61a2
SHA1

cc3384f01d203608d5486dae8846c0177b877441
SHA256

d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f
SHA512

55e18c290ba5030701733a1d1947643037c754d762ac50d36c4446922a66070a26157353a8aeca7f79b848425695eb06028f1c02c5a8bcd261f6f82ca1ab4e25
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:7rKo4ZwCOnYjVmJPad

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80
PID 5116 wrote to memory of 4108	5116	d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe	80

C:\Users\Admin\AppData\Local\Temp\d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe
"C:\Users\Admin\AppData\Local\Temp\d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\d38d54b1d810cc1645a26d446c3d6be2c34c4916a82ac049e98209232000a88f.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4108

memory/4108-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4108-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download