fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 19:53

Target

fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
Size

300KB
MD5

8407e9005b1ed4157b05fcdc285c1f60
SHA1

9e03ef705beeb2a0d29aee0384a5621d65b172ae
SHA256

fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c
SHA512

c04a0e6729535e6896989e79b68d52caa7b56862bf6ce86d4365422d6f28adc89a607907f39872fcab82493eab258c4c98626ec225d87f07b6bcbb5c8a26a80c
SSDEEP

6144:5z1QJ4VDOK7vn4r8nUinLlL2Oz0K7FIMweoxu10jP:5eJiNQr8nUI2O4Kzoxu1+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81
PID 3480 wrote to memory of 3608	3480	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	81

C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
"C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
  "C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe"
  2⤵
  PID:3608

memory/3608-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3608-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download