d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba

Analysis

max time kernel
144s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 13:42

Target

d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
Size

1.3MB
MD5

78b96e64dcd0e53c77136073ab7432f8
SHA1

abcc823e371b8e96a9d456823a3b65d000d14268
SHA256

d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba
SHA512

996b8656c0b0e1bb124846b0b045f7b01aec92148e94fecacae5390d00a7b1f4597f4bd758cc9e1ec02271d38143958284ca8af8178698c9380de0f38e79d0f6
SSDEEP

24576:YOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9:xi1DWLFP53UGe76x0ZUphdt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1712	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
1712	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
1712	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
1712	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
1712	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80
PID 3068 wrote to memory of 1712	3068	d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe	80

C:\Users\Admin\AppData\Local\Temp\d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
"C:\Users\Admin\AppData\Local\Temp\d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\d0cc3be3db4214e27f0b19178d4782ed776785fc63b20cffcfc52fd1a4a36cba.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1712

memory/1712-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1712-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1712-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1712-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1712-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download