15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 22:36

Target

15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
Size

1.4MB
MD5

4b970f65aa5e207f42f2aba2d07a98c8
SHA1

22ea4e27bc06d6878e416d402763ec876182aa66
SHA256

15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01
SHA512

cd5458dd7f03bd13488ea7d42b8b50197d140b377136994a4f95527dcb48a5bdf3da54ea3542d40db54c89899e28a6c045ad113fdbb4f4927d273e88c450fb25
SSDEEP

24576:Qy83rXf95JRrVwk52X8DL2ZaVVk7FcAm6ycERLdDzUbBtEpZvj0j5e:Qy8hFykeu2ZykaAJyrRZYBtEF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1528	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
1528	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
1528	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
1528	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
1528	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84
PID 4444 wrote to memory of 1528	4444	15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe	84

C:\Users\Admin\AppData\Local\Temp\15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
"C:\Users\Admin\AppData\Local\Temp\15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\15b9cce912307bac59615b8144acbf782b5a5d0f3572a3fdade539512adf3b01.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1528

memory/1528-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1528-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1528-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1528-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1528-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download