caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a

Analysis

max time kernel
168s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 21:59

Target

caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe
Size

205KB
MD5

83e48af1c58bca31112e447a30eaadee
SHA1

bcc0dc96a1a4989a1d90e7ef997da10fe8802623
SHA256

caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a
SHA512

ff755972582a78225a3ea35b75ef7f02ac8d1fd7e0a48955643ca40fb3127234aad4ed9ffd2a5362478ad3ed247160bcf46cb9df5ed2e25eb9d2afc1400c013e
SSDEEP

3072:GBo06yohsa6XLnxQ5h480DqBRhVh8njm9VCEGKH+YOMp7Ld7Gkcm/:GAb9SC2DqBRhVh8njm9VCwH+ep7Ld7Gu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4220 set thread context of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79
PID 4220 wrote to memory of 3088	4220	caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe	79

C:\Users\Admin\AppData\Local\Temp\caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe
"C:\Users\Admin\AppData\Local\Temp\caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe
  C:\Users\Admin\AppData\Local\Temp\caaf8d910718e017e097752ca38c5ccf4abebfaa4c90e1e5c336ebee1c09fe3a.exe
  2⤵
  PID:3088

memory/3088-135-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3088-137-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3088-138-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download