c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9

Analysis

max time kernel
157s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 15:34

Target

c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
Size

224KB
MD5

2afd9390bc8706cb2a3c74339082c75f
SHA1

2525b3a5a337dad351f9a8a6bf8bbe8fcc8889cb
SHA256

c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9
SHA512

1da0fcd03a84c47c5f70063dd193da4f3a4c768e4424c0d60b120321938576a1691f5e6cc0b473c179b5125830fe87815bbebead2f3f383923d4c57ac04be80e
SSDEEP

6144:6aRdxGgC4Cdm+QQNfHy08pb6ilGqbyXlc7claAjv+7epZQnONzI:6M+ghY2pbZGGC+cwt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

description	pid	process	target process
PID 1872 set thread context of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

pid process

1872 c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

pid	process
1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

description	pid	process	target process
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
PID 1872 wrote to memory of 2700	1872	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe	c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe

C:\Users\Admin\AppData\Local\Temp\c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe
"C:\Users\Admin\AppData\Local\Temp\c1dbe3b2727390cd9b5fbc1cdffcabdc07a2a0d6d8ee8233d9f4727191ea3cb9.exe"
2⤵
PID:2700

memory/2700-134-0x0000000000000000-mapping.dmp

Download
memory/2700-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2700-137-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2700-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download