4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 22:12

Target

4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe
Size

1.4MB
MD5

f59c5730e60f716e0808c98382210d9f
SHA1

db70f7bb4550710b278770ba7abd3ab738baeecd
SHA256

4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03
SHA512

5ed5676f07141c61728a0939ff81661ece23f3d7ef458d6d88dffdf9f841f9e8c5fda9a02b42fcd5a13a72c6fa2ba0672096f857a3b0e5e2959b51d18b309b5a
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8A+:BrBew72604doSw6ewp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84
PID 4316 wrote to memory of 4344	4316	4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe	84

C:\Users\Admin\AppData\Local\Temp\4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe
"C:\Users\Admin\AppData\Local\Temp\4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\4aba480f9328581af0541b69b89a03cb1746025767ed69d4eb7dc07041a39f03.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4344

memory/4344-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4344-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4344-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4344-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4344-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download