a032fd22cc8ac93ad5ee63707797119630b5a0adde67ef7957759ce46a9148d4

Analysis

max time kernel
3s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 17:51

Target

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
Size

148KB
MD5

d1899adf595eb4ca5e286b23da1ddd4d
SHA1

4c9bfa6704addd02c1342deeea891dcaa6101749
SHA256

df3092634eba62ecb09399f93a7af74cb2d9e3a188328ad102bf129296ccb80c
SHA512

8ad5ed3931145cc8c78ce9d43b8bf8bfbbd68837b454c6f96233c7a465e88fb12c81b4ba8ea9cc98def92f6eaf10c40dde8677bbf013316b41d6718a9d8fb47a
SSDEEP

3072:G4VisC5+09/kL7y64qeefjDkGQYAce5oyltMFhy:v2g096eMjDkGQboylKXy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3796 set thread context of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 3796 wrote to memory of 1960	3796	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	80
PID 1960 wrote to memory of 4212	1960	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	81
PID 1960 wrote to memory of 4212	1960	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	81
PID 1960 wrote to memory of 4212	1960	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	81

memory/1960-132-0x0000000000000000-mapping.dmp

Download
memory/1960-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1960-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3796-134-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download
memory/4212-137-0x0000000000000000-mapping.dmp

Download