812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03

Analysis

max time kernel
162s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 21:48

Target

812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
Size

1.4MB
MD5

25d2e5bc94f22259217a68a5fb100226
SHA1

dec816fe2df27be4ec8a432280608a29f7bd02f3
SHA256

812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03
SHA512

dc87b46e89f8175cd77b62f8d7a03ac2242c5430962d02ce8b972c61ba2fe35bceb99a26abc8c932e71fa5b4db2500dcf3924e7abc11f1b187f1a3657e21194d
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ay:hrBew72604doSw6ewF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3168 set thread context of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3320	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
3320	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
3320	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
3320	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
3320	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82
PID 3168 wrote to memory of 3320	3168	812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe	82

C:\Users\Admin\AppData\Local\Temp\812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
"C:\Users\Admin\AppData\Local\Temp\812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\812d37dcc4cb69899f379e7c9e53bd53a3f4cf4c2ca2c58373565f6cd69e7d03.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3320

memory/3320-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3320-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3320-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3320-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3320-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download