98fddc19ef07305d4b84e3d570e7853efb0c90568644445393d94f1b7d15ea5d

Analysis

max time kernel
154s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 15:31

Target
d3dca7edd66cb866726fb0c0eae92a80.exe
Size 540KB
Sample240318-sx67msce8y
SHA256 98fddc19ef07305d4b84e3d570e7853efb0c90568644445393d94f1b7d15ea5d
MD5 d3dca7edd66cb866726fb0c0eae92a80
SHA1 2e297d177f5f7b8f1db926cc51a37fb7d145bc3e
SHA512 de8e02b51aa2d46003d38c48aeadff404111483cb561d08bf7fb7bfc0e86632c141971f2f5643e136fb53c6d9da05b1a4db06a33f0f1590675733477489d4849
SSDEEP 3072:ST9f2X0e1FB/DpKjCLHfdgULj5nGiVeLTJ/jq:Wu5GiVeLTJ/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4224	d3dca7edd66cb866726fb0c0eae92a80.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95
PID 4224 wrote to memory of 2608	4224	d3dca7edd66cb866726fb0c0eae92a80.exe	95

C:\Users\Admin\AppData\Local\Temp\d3dca7edd66cb866726fb0c0eae92a80.exe
"C:\Users\Admin\AppData\Local\Temp\d3dca7edd66cb866726fb0c0eae92a80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\d3dca7edd66cb866726fb0c0eae92a80.exe
  C:\Users\Admin\AppData\Local\Temp\d3dca7edd66cb866726fb0c0eae92a80.exe
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3776

memory/2608-2-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2608-5-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2608-4-0x0000000000400000-0x0000000000408960-memory.dmp

Download

memory/2608-6-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2608-7-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2608-9-0x0000000000400000-0x0000000000408960-memory.dmp

Download