9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 20:32

Target

9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
Size

205KB
MD5

81209252524c58378cbefb37da3f8e40
SHA1

6c922e2e8df4658b6682131bde3b28bc7be6c22c
SHA256

9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec
SHA512

f9b0caafbec16bbc0a788ec05dc995421ff17440c64837f50ee426b18c9c51c17444ef7367b314bc20572541e329913d623dc78ac5fda5a796d79ba410a7b706
SSDEEP

3072:6BY06yohsa6XLnxQ5h480DqBRhVh8njm9VCEGKH+YOMp7Ld7Gkcm/:6Qb9SC2DqBRhVh8njm9VCwH+ep7Ld7Gu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81
PID 3044 wrote to memory of 1260	3044	9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe	81

C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
"C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
  C:\Users\Admin\AppData\Local\Temp\9d42c86d536c16221229c911cc7ef993f24653fec567a9b32aecc8730a46ecec.exe
  2⤵
  PID:1260

memory/1260-135-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1260-137-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1260-138-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download