bec7d56d5b24dcee2643d58aa32d08155e0ef6d0ae5e9cc4635daa3ad82154d5

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:07

Target

0c80594bd623ed1ea9f273e7b2928225.exe
Size

208KB
MD5

0c80594bd623ed1ea9f273e7b2928225
SHA1

b1434cef059c0a661ae9df1cf4494b3e133884d6
SHA256

bec7d56d5b24dcee2643d58aa32d08155e0ef6d0ae5e9cc4635daa3ad82154d5
SHA512

ba4bd5a8ebb35d10d1d8cc737cf8b801b6fcebb8df33a5003fce2af938fa081a6fe83391f33140db7284f80fdbbdb0d5783744afbcd7b2764714e4af11fceaff
SSDEEP

3072:A5N95mwXQhBmpYgWTk0lqF3sYJfaKqwXGHDbAePXeKr55FX8zx61B:2z5LQh5gWTkLFcYNaKqwXG4suOUu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2556	0c80594bd623ed1ea9f273e7b2928225.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54
PID 2556 wrote to memory of 4948	2556	0c80594bd623ed1ea9f273e7b2928225.exe	54

C:\Users\Admin\AppData\Local\Temp\0c80594bd623ed1ea9f273e7b2928225.exe
"C:\Users\Admin\AppData\Local\Temp\0c80594bd623ed1ea9f273e7b2928225.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\0c80594bd623ed1ea9f273e7b2928225.exe
  "C:\Users\Admin\AppData\Local\Temp\0c80594bd623ed1ea9f273e7b2928225.exe"
  2⤵
  PID:4948

memory/4948-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4948-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4948-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4948-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download