78c30900056226cbbc3a85bf017ed5f500c9c8f548cc186465f6d0eae05259ea

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:36

Target

1a103bd02776e2cb2de8a3ccf9d7ad51.exe
Size

25KB
MD5

1a103bd02776e2cb2de8a3ccf9d7ad51
SHA1

0b12893a61f42c0ee6239b2068aa61294f5fbb6f
SHA256

78c30900056226cbbc3a85bf017ed5f500c9c8f548cc186465f6d0eae05259ea
SHA512

03c39312cf3584dcd167d69c4b690fd54cd506088a57c1b837f72ab5e4050fe30ae965ae9231c2b9cdb78d701c3254456d24a9f1f4575be927118552b66295fc
SSDEEP

384:Zt2YP9EzHJMeS49XPpGlzJvWEf7vvxlL/aHlhMJKvL:31ExS49fp+zJe+7D/aHFvL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4332 set thread context of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86
PID 4332 wrote to memory of 1800	4332	1a103bd02776e2cb2de8a3ccf9d7ad51.exe	86

C:\Users\Admin\AppData\Local\Temp\1a103bd02776e2cb2de8a3ccf9d7ad51.exe
"C:\Users\Admin\AppData\Local\Temp\1a103bd02776e2cb2de8a3ccf9d7ad51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\1a103bd02776e2cb2de8a3ccf9d7ad51.exe
  "C:\Users\Admin\AppData\Local\Temp\1a103bd02776e2cb2de8a3ccf9d7ad51.exe"
  2⤵
  PID:1800

memory/1800-3-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1800-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1800-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4332-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4332-6-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download