e9807bc7ce325115521baf482d46e38797c5ebb85c976e9b93b70c3251e9862e

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:35

Target

643ceeeb781d5545de51a823900fc62a.exe
Size

352KB
MD5

643ceeeb781d5545de51a823900fc62a
SHA1

bcc545bf0b4f0425a37a4f42f7245f001f219501
SHA256

e9807bc7ce325115521baf482d46e38797c5ebb85c976e9b93b70c3251e9862e
SHA512

9baf9aaa6ea3b45c0e7874d20c44c92508721f60ce6198bed601065253a01fdc9473f8fb320d4b1ecb2347e5f14f83168af07bb07dfcbb3f602b57fabace6304
SSDEEP

6144:ax/Is+zUK7ayLY7aQEwhJ98bEkxyLvorDgSKgK:Ts+tY7aQEwhJ94EkxOvorDe

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4504 set thread context of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 set thread context of 0	4504	643ceeeb781d5545de51a823900fc62a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	643ceeeb781d5545de51a823900fc62a.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 1924	4504	643ceeeb781d5545de51a823900fc62a.exe	89
PID 4504 wrote to memory of 0	4504	643ceeeb781d5545de51a823900fc62a.exe
PID 4504 wrote to memory of 0	4504	643ceeeb781d5545de51a823900fc62a.exe
PID 4504 wrote to memory of 0	4504	643ceeeb781d5545de51a823900fc62a.exe
PID 4504 wrote to memory of 0	4504	643ceeeb781d5545de51a823900fc62a.exe

C:\Users\Admin\AppData\Local\Temp\643ceeeb781d5545de51a823900fc62a.exe
"C:\Users\Admin\AppData\Local\Temp\643ceeeb781d5545de51a823900fc62a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\643ceeeb781d5545de51a823900fc62a.exe
  "C:\Users\Admin\AppData\Local\Temp\643ceeeb781d5545de51a823900fc62a.exe"
  2⤵
  PID:1924

memory/1924-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1924-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1924-4-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1924-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1924-7-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1924-9-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1924-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download