dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38

Analysis

max time kernel
197s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:37

Target

dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
Size

1.5MB
MD5

5d6e7b56aa7c2ce4fba93b76e3d7203f
SHA1

3b46fd34f936e9131144cf5ad2143b8a4b075e4e
SHA256

dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38
SHA512

5236500db3068b08135f5c5ef35645f65ea468ba9af30e23f3602115d4bff343c3696d800b184e79c008db48a432fc2a70a19609e9685af28c6e3e607ebb2146
SSDEEP

24576:rPEzeDWtazKrcVWv+FjisSOZYjmOdXQ+ARZoQWnQUwMlds0VwI/9Mx:rIwwImsMqQA57oQWcGdsyw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1536	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
1536	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
1536	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
1536	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
1536	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81
PID 3192 wrote to memory of 1536	3192	dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe	81

C:\Users\Admin\AppData\Local\Temp\dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
"C:\Users\Admin\AppData\Local\Temp\dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\dd7f7aeed257def03e08ad7ebb9d1b01a209bdef0958ece6862ecf408a589a38.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1536

memory/1536-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1536-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1536-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1536-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1536-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download