a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 21:34

Target

a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe
Size

1.4MB
MD5

d9f7cf51f445c9e1888bbfaf44348731
SHA1

ba89205da32600976fa327577f234573a43c797d
SHA256

a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09
SHA512

3e13956042493a437e859af57ac7ed7dba592cee07f60003ef76c2a744aeecfa525df456a3d0395f4418f7a8b14191dfde84dda14107eb14398413aab130c721
SSDEEP

24576:RrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8At:RrBew72604doSw6ewe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82
PID 2808 wrote to memory of 864	2808	a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe	82

C:\Users\Admin\AppData\Local\Temp\a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe
"C:\Users\Admin\AppData\Local\Temp\a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\a3fe0f59c8dffba12063508535e13d803103a110813dd9f6b96273082e5b2c09.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:864

memory/864-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/864-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/864-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/864-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/864-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/864-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download