828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c

Analysis

max time kernel
362s
max time network
403s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:22

Target

828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe
Size

669KB
MD5

7f376e4b8dd0221c853e22f317c682cc
SHA1

6803c5aca107a1b4987ae89b46a34dc61eb45286
SHA256

828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c
SHA512

7deb347a2e2d5b9097ebd9a4435a0f7d8db966996bdc8daca2fd377023b0fd804a2d0ac06466cbc8a874f94033591477cf356b6324e23e8fff22d86e984fb4b0
SSDEEP

12288:MUpD3ddud5Y1wEsWLPRE3Hok/5mYNY2N:j7dUu1ZsKPRE3Hl/ZN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80
PID 4756 wrote to memory of 2440	4756	828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe	80

C:\Users\Admin\AppData\Local\Temp\828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe
"C:\Users\Admin\AppData\Local\Temp\828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe
  "C:\Users\Admin\AppData\Local\Temp\828784f22dc7c77cfbd00d5f20cd5482c8b7a5bc4f4a376812c21a385f01170c.exe"
  2⤵
  PID:2440

memory/2440-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2440-141-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2440-143-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4756-132-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/4756-135-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/4756-136-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/4756-137-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/4756-142-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download