dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e

Analysis

max time kernel
202s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 01:00

Target

dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
Size

1.2MB
MD5

34f2fc4cc295ddb2bb16517a5a0ae94d
SHA1

5b8e968e61df0bb55fa12292f4f9e769815f5ee3
SHA256

dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e
SHA512

2f7c897279bee482b71a7981b6b8833b3aff6cdf3c51425511a2e364c65c34b041e26d34cfa9d896aba166e3a5baeb8f9c947d93fb27d0d9b4c568817e3dbb9e
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMj:EEqmvxD3pRaLcZIg+s

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1888	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
1888	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
1888	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
1888	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
1888	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84
PID 220 wrote to memory of 1888	220	dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe	84

C:\Users\Admin\AppData\Local\Temp\dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
"C:\Users\Admin\AppData\Local\Temp\dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe
  "C:\Users\Admin\AppData\Local\Temp\dcdc579cbe543cd1db39452634ea24b55e19d6fe411eca2f83ea8f56a8dacb3e.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1888

memory/1888-132-0x0000000000000000-mapping.dmp

Download
memory/1888-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1888-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1888-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1888-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1888-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1888-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download