d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:42

Target

d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe
Size

1.5MB
MD5

c2bc677e51eae15b24a0d5e504ea2bdf
SHA1

01dad7a31d5a7e85ecfcd6a0459f66ce86f07d25
SHA256

d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084
SHA512

30b471672294db1a4e0856498c0dd02928d6c5a3417ecf993662a92788fe63c7078902a9bbe283535cef0ce149976daf0dea4370119acef9a066ca5a68ff26b0
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+Y:YIBfvMkrNrf0u3qdaNLgQWiO+4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81
PID 2824 wrote to memory of 4908	2824	d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe	81

C:\Users\Admin\AppData\Local\Temp\d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe
"C:\Users\Admin\AppData\Local\Temp\d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Temp\d95cae8bf595176e018d8cc0aa108f6ec411b7b71967e46f99540972a37d6084.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4908

memory/4908-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4908-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4908-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4908-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4908-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download