52d57d4aedffbc40cb4fea53ff9ebe4888fd0d8aae7617e04ed25aa4d3152559

Analysis

max time kernel
1s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 17:50

Target

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
Size

148KB
MD5

550cedc7d5193567845e5cd5fe4fc13a
SHA1

8da0c69308247b794945c3368bcc02d3f2ce7e43
SHA256

057947a26e0c5965d6a26b6fcab363aafadd5264c5930fff4371f353ac34bd9f
SHA512

fb140bd485f6dcf1428dc39bf22acdbb4af0da629c586d24083f5d6d84362a7a0703e739e7ad8614fd7ca8737e8d9d718183e9f9066eacbc6501f6bfe009c8e3
SSDEEP

3072:ZVis2aoOF6BWDe7Awqx5ekBjsimmE2HqDi8m7AW:LgWt9x5ekBjsPmExDDm7AW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4728 wrote to memory of 4252	4728	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	82
PID 4252 wrote to memory of 4988	4252	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	83
PID 4252 wrote to memory of 4988	4252	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	83
PID 4252 wrote to memory of 4988	4252	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	83

memory/740-138-0x00007FFFADAD0000-0x00007FFFADAE0000-memory.dmp

Filesize
64KB

Download
memory/4252-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4252-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4252-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4728-135-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download