9671aa55a34fcecf2291e8173a407782d113f40f74b002ac3c02c89f0b04b454

Analysis

max time kernel
143s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 16:31

Target

7ce20695a046d0aed64f1fb1e0c83d22.exe
Size

592KB
MD5

7ce20695a046d0aed64f1fb1e0c83d22
SHA1

5595c9c81e90ac320d6c90da35c87a69743da69b
SHA256

9671aa55a34fcecf2291e8173a407782d113f40f74b002ac3c02c89f0b04b454
SHA512

494e4af7d9c384879e202850418d7a045b8419ae9967527b6410f20b30a97b61dca8304e4f14e6090bcda11216056dc6faa8b12bec4c76c9688faaf64227fe74
SSDEEP

3072:4Fb5LlM11Gvbec1YdRmbh8f4TCsKp9hJm/KzopkhUrloBLCWZ1wK/+70uCYpd4R/:oec8mbajsKdJ6KzopzrloR9wK/oyRDh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3828 set thread context of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	7ce20695a046d0aed64f1fb1e0c83d22.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20
PID 3828 wrote to memory of 3436	3828	7ce20695a046d0aed64f1fb1e0c83d22.exe	20

C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
"C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
  C:\Users\Admin\AppData\Local\Temp\7ce20695a046d0aed64f1fb1e0c83d22.exe
  2⤵
  PID:3436

memory/3436-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3436-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3436-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3436-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3436-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download