d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb

Analysis

max time kernel
193s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:46

Target

d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
Size

1.3MB
MD5

496a67289a026149e38ecebe96282c4c
SHA1

9e5b8d3b4c1dd03f4a6455bae12a8c9e7caf6a6b
SHA256

d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb
SHA512

ca47e39000fe2578ee0c5dab7dd791f557b9b02267f563c425fcd842f54511f65143eeca378c8a03f692df9629012126ac103387efd03175111c88501850cb70
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
216	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
216	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
216	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
216	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
216	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83
PID 4236 wrote to memory of 216	4236	d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe	83

C:\Users\Admin\AppData\Local\Temp\d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
"C:\Users\Admin\AppData\Local\Temp\d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\d61f8b09c227550416beb700b6bdc199065caf961289a518f790290dee1fbddb.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:216

memory/216-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/216-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/216-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/216-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/216-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/216-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download