9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd

Analysis

max time kernel
80s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:31

Target

9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe
Size

193KB
MD5

432cb057c8b64e23cdcc43c7e43f835a
SHA1

dc91915b7e433279f4835068568ec8450d2efd04
SHA256

9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd
SHA512

d4cb5c92527a21ef452c981247300c9aaf62341a9b2ea26aee731d3b29f021e0d87326896e3baa6b181b2041c47e613c9fe1a2021a4e24ef026ee8e657629c3a
SSDEEP

3072:LaDNI+FjNTjuO8zYkS6P+pmjVItNz/jO71r06JvJiPn29D+55HSk99XJcTphigTw:g2MjNWspjNHSkEommah9sF3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3724 set thread context of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80
PID 3724 wrote to memory of 2372	3724	9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe	80

C:\Users\Admin\AppData\Local\Temp\9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe
"C:\Users\Admin\AppData\Local\Temp\9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe
  "C:\Users\Admin\AppData\Local\Temp\9439ebbecd88dfa9aa25514bf237e5d341460e7308d54410f03a628ded82d9cd.exe"
  2⤵
  PID:2372

memory/2372-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2372-137-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2372-138-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download