ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9

Analysis

max time kernel
170s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:43

Target

ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
Size

1.2MB
MD5

1f3c5b6e804295d747550f5690e4185b
SHA1

5ebbc4eb8d856e0d199f3144f24a8b9fb8dd0f09
SHA256

ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9
SHA512

c6c78fa0c5a3615708ae093384e825938c8ce535716d914f7061904a1f36ac42aa9c7a9f79e0d49b3a6ecad346e5d61a682f4da42752b05837aab4ebbe5eb5c7
SSDEEP

24576:J8Ax9GLS59Q2SQUVqyeFtBJepApojDkfW/1RJMGdmXF:h955i2S5VFIBJewerJMkmV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4972	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
4972	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
4972	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
4972	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
4972	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83
PID 1620 wrote to memory of 4972	1620	ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe	83

C:\Users\Admin\AppData\Local\Temp\ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
"C:\Users\Admin\AppData\Local\Temp\ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\ad677ecfb286bcd0ca350cb3b77a0765644a99f93031a9dc9cfadfe85039dfb9.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4972

memory/4972-133-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4972-134-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4972-135-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4972-136-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4972-137-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/4972-138-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download