ddd13d218386496265571a556752f1ce401b8a14953fbda5a69f59d472cd55a2

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:44

Target

05df72623d2b5dce659505a30167c50b.exe
Size

276KB
MD5

05df72623d2b5dce659505a30167c50b
SHA1

4677a2152ed1c78a9ac1242712feb837bc809ef9
SHA256

ddd13d218386496265571a556752f1ce401b8a14953fbda5a69f59d472cd55a2
SHA512

1b4da3f0cc7c1d29067c8bb1c7aa951d2e2bc4a5b53eceeb4fc7eafbf9f6044dec7dc13ca5361be9c2984fe305b93fef279f2a45d7a404611cc2a94c4d8449c9
SSDEEP

1536:goR34MJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHolAu1Tqn1KSr:gSX0e1FB/DpKjCLHDC1Ks8z3+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2408	05df72623d2b5dce659505a30167c50b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20
PID 2408 wrote to memory of 3412	2408	05df72623d2b5dce659505a30167c50b.exe	20

C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe
"C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe
  "C:\Users\Admin\AppData\Local\Temp\05df72623d2b5dce659505a30167c50b.exe"
  2⤵
  PID:3412

memory/3412-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3412-5-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3412-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3412-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3412-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download