aad5ae8b10868548e523d9394066ca957a048342217075a6aa689cba091677de

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 17:07

Target

7d88b9eeed6b4aee5c36d31ff6aa383e.exe
Size

281KB
MD5

7d88b9eeed6b4aee5c36d31ff6aa383e
SHA1

47d3ce4a35da51d624a1fdd3de0edc6b605f6162
SHA256

aad5ae8b10868548e523d9394066ca957a048342217075a6aa689cba091677de
SHA512

a380454d09f39e510d86963fe433d9500cf471232632bab4af3f8323b758594537e659944f1863d7efe23c56a43e9a00e2f6148791270b8d51eef6c40531f0f6
SSDEEP

6144:uCT6tqpRv7Va5qSirHJbLNyzZQFjLSu1QinB/:Lv7QA1HJb5yzqRSu1QiB/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86
PID 5016 wrote to memory of 2344	5016	7d88b9eeed6b4aee5c36d31ff6aa383e.exe	86

C:\Users\Admin\AppData\Local\Temp\7d88b9eeed6b4aee5c36d31ff6aa383e.exe
"C:\Users\Admin\AppData\Local\Temp\7d88b9eeed6b4aee5c36d31ff6aa383e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\7d88b9eeed6b4aee5c36d31ff6aa383e.exe
  "C:\Users\Admin\AppData\Local\Temp\7d88b9eeed6b4aee5c36d31ff6aa383e.exe"
  2⤵
  PID:2344

memory/2344-11-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2344-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2344-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2344-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5016-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5016-3-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5016-6-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/5016-5-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/5016-10-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5016-8-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/5016-4-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download