47b29b3642240a38bb966b6213172f32bf63226c346236184e9144fc6bc461bd

Analysis

max time kernel
146s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 08:37

Target

4dda616237867cbf3a6527d943e2445c.exe
Size

68KB
MD5

4dda616237867cbf3a6527d943e2445c
SHA1

016b5adc058fe1f61fe29f83baf2498ac911d428
SHA256

47b29b3642240a38bb966b6213172f32bf63226c346236184e9144fc6bc461bd
SHA512

be38bdd9b00b0cc63876391154b23b88b0ebdaaa29974c03ca4914c8dd946a8f9b2ab59d38cb8323cc1a2bea579b9cd253118cfb3db70480b276dfabd6925506
SSDEEP

768:VQcepF+Yxt+mV0eMwd1Jg5YUFfbihi8x1A73mLqaX7UCTR+jrjaE:SceH+Yxt+WJlg5dTihXDuPaE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	4dda616237867cbf3a6527d943e2445c.exe
4728	4dda616237867cbf3a6527d943e2445c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16
PID 1468 wrote to memory of 4728	1468	4dda616237867cbf3a6527d943e2445c.exe	16

C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe
"C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\4dda616237867cbf3a6527d943e2445c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4728

memory/4728-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4728-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4728-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download