ecaa1c280350845a2c043a7d3244efefc8a671291f81b81cec0060af1ce198ca

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 10:37

Target

7ce6c417c4dcc18d3814be3952a7f59a.exe
Size

43KB
MD5

7ce6c417c4dcc18d3814be3952a7f59a
SHA1

3a65c1ff41bcad70af40d75465256ebaeed77994
SHA256

ecaa1c280350845a2c043a7d3244efefc8a671291f81b81cec0060af1ce198ca
SHA512

cfb016b4a4d3b9ec0cee411016e69aba91f8323f1e0200256503f4c795ad089527f738141909dbd3dfa0f88d1de633d01a18836fef884b5385267affa7ab0a25
SSDEEP

768:wC19DlJj0nxV8gMxXyyAdCWM67ayAZCQ3th5aO2rqsNwiE0Q14Psr7DL:wCPRzxXG57aylQ9hr1svE084kP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3356	7ce6c417c4dcc18d3814be3952a7f59a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86
PID 3356 wrote to memory of 5012	3356	7ce6c417c4dcc18d3814be3952a7f59a.exe	86

C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe
"C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe
  "C:\Users\Admin\AppData\Local\Temp\7ce6c417c4dcc18d3814be3952a7f59a.exe"
  2⤵
  PID:5012

memory/3356-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3356-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5012-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5012-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5012-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/5012-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5012-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download