96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 21:39

Target

96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe
Size

1.4MB
MD5

1099c63dc78a2174b5f87305f2853bc3
SHA1

265c97f22fc68eefb4669c8aec363aed0ba99b7c
SHA256

96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab
SHA512

806f00f50636ae925abcc12e05a9888b1377741f4d27ea164c28ffc5abeea6da725ade08e334b20ff47cc0b0c403aaf300af02434a937e5bd61a5f84e595abb0
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aj:hrBew72604doSw6ews

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80
PID 2620 wrote to memory of 3880	2620	96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe	80

C:\Users\Admin\AppData\Local\Temp\96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe
"C:\Users\Admin\AppData\Local\Temp\96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\96e61e2eb3a7893071c54f97917f13609108421bb053c0b0ef7f3e053c7481ab.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3880

memory/3880-132-0x0000000000000000-mapping.dmp

Download
memory/3880-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3880-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3880-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3880-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3880-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download