3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41

Analysis

max time kernel
160s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:21

Target

3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
Size

1.0MB
MD5

69981dadb6c0d9373e35a6f302207071
SHA1

f9d3405fc1b9e6bef4545594c264cd311205f663
SHA256

3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41
SHA512

a06d8f59457815fa9bc4089208deb01cd30acd3f614120ddce421a87a10ac17181b100c49da1f912ed35454d449285610728247f64aa0509b421b799e7d113c6
SSDEEP

24576:/FPX97BbdQstJ2C/iN7F+ClRV95ZAuvjZtD3C:/FPtVdRtJ7qT7lRv5ZAuvNE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2260	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
2260	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
2260	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
2260	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
2260	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77
PID 4844 wrote to memory of 2260	4844	3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe	77

C:\Users\Admin\AppData\Local\Temp\3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
"C:\Users\Admin\AppData\Local\Temp\3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\3c1993c349e0df3e2cec7c7fc6ddac4d006a1ebc94988b9e881a6aa1e2260f41.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2260

memory/2260-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2260-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2260-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2260-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2260-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2260-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download