55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321

Analysis

max time kernel
208s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 06:16

Target

55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
Size

1.5MB
MD5

f7e76694da9f8d247b6a75f62ab1dc40
SHA1

f0e770517eddb5e730810f5937e6744e87c25a35
SHA256

55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321
SHA512

0b2cc871f5361284697fbe4eefea2378a2ff6815905b486202ffbbd91f3e4e783218aee9a63811c9173f6d099f7576ec9f15072344bb39e291e0af2c51986e0b
SSDEEP

24576:z6Lk1sQfWDZtaXR5x0UHcuUWw0DKEXE+f5npKp8HYMtZkMogTAHl1DZIY50u3phh:GLk1GZcdcuXdFnpKp8HlIMoksLDZLGQp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe
3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 3236 wrote to memory of 1228	3236	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	85
PID 1228 wrote to memory of 3544	1228	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	89
PID 1228 wrote to memory of 3544	1228	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	89
PID 1228 wrote to memory of 3544	1228	55d3ef83192776f3fe52d7a8ad3e2e3e8017aaa7b47b17a683026e18420d5321.exe	89

C:\Users\Admin\AppData\Roaming\3509NsCf63HGsyYA73.bat

Filesize
201B

MD5
cab696c134b1730bb07b57e6cc3d3aa6

SHA1
96d8d93878e6a5511326e3479b525f44cb34b4ee

SHA256
f424be20304238861e1300f80b876e68fc1fde2d90e88d1a8a8a1cf87573d4c9

SHA512
313efa073275afbc4cf672e212f39ddcf10df9bbf2d13f0cd615b7700de5050ec80f7e82a3720fb717d1e3b4ce85e9eb4790704154fb05adf80d512fc10f1326

Download Submit
memory/1228-134-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1228-135-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1228-136-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1228-137-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/1228-139-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download
memory/3236-132-0x00000000007F0000-0x00000000007F4000-memory.dmp

Filesize
16KB

Download