dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74

Analysis

max time kernel
182s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:21

Target

dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe
Size

626KB
MD5

90b32bfbad9c04648837340e3a3b1ebb
SHA1

9643dbb932ccd945c6bb010d82a0961cf8df57e3
SHA256

dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74
SHA512

9835e5324142277bbd0f9135c0529ae60702adc26a8820529171b87c7468968d19799f0c384969ed30138f5db8e05646043be736f15b2fc825a4ab09b5fb70d5
SSDEEP

12288:vVdPTEH1bjgXkZc7wrMw2KWQDdTWEk96qKcojh4wzvHlGvB3d9HPd9Hc:t+5jgEMwrMw2KWwWN91bSh4etsB3v8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3788 set thread context of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79
PID 3788 wrote to memory of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79
PID 3788 wrote to memory of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79
PID 3788 wrote to memory of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79
PID 3788 wrote to memory of 3964	3788	dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe	79

C:\Users\Admin\AppData\Local\Temp\dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe
"C:\Users\Admin\AppData\Local\Temp\dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe
  C:\Users\Admin\AppData\Local\Temp\dd53da4db829f013fe4436df5f5ea8fef30a9b58733a765fe9356f72ee0b0c74.exe
  2⤵
  PID:3964