199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd

Analysis

max time kernel
162s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 22:34

Target

199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
Size

1.4MB
MD5

f035bdda1ecf8cfc87bc9ba7ce083b52
SHA1

a8a3202a91f237f38be2d2928f228e211162f185
SHA256

199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd
SHA512

34c3c5374c477e2d0bd104d5c1ee32e2e4c6519f5f2dffe2be359dba0a0791eefa87b29af203d821cf553f5e7ee9052abd66c7e5c578d27aaaeac80bf67abe0b
SSDEEP

24576:0KWQBT4nVU85afaniK/792DxAA4PNn0DLg78E2y2R3rh+Zx1kyFA:0NQJJ2B2WZd0DUGf3d+ZLkye

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
384	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
384	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
384	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
384	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
384	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83
PID 5072 wrote to memory of 384	5072	199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe	83

C:\Users\Admin\AppData\Local\Temp\199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
"C:\Users\Admin\AppData\Local\Temp\199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\199c8db6c89e5f8323309ddf1148ae15e94e15082d6760b3dbbd9daaec2b98fd.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:384

memory/384-132-0x0000000000000000-mapping.dmp

Download
memory/384-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/384-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/384-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/384-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/384-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download