381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db

Analysis

max time kernel
158s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 22:21

Target

381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe
Size

1.4MB
MD5

188107e6a16cb48de7c08e485a0fab9a
SHA1

f152a52326e934d397fed45335314071e003e6ef
SHA256

381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db
SHA512

6a5d60e7a42eabb2d79188cb6cb082a92edc81fa8f5fa429bb9bcbf7155bf458a09ae41748451c7d6449d4d4cd7c4bc864d8af393487f023047ba6dc40d80539
SSDEEP

24576:xrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AX:xrBew72604doSw6eww

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4124 set thread context of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82
PID 4124 wrote to memory of 2196	4124	381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe	82

C:\Users\Admin\AppData\Local\Temp\381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe
"C:\Users\Admin\AppData\Local\Temp\381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\381fee02c7e05c4d3e7ba9322ec627a7384705769d43d001448f43744e2740db.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2196

memory/2196-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2196-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2196-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2196-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2196-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download