019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 22:45

Target

019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
Size

1.4MB
MD5

b53905a652d721eddee38716bc2b773b
SHA1

f61315b91de6111812d552e048c99f30ff0123cb
SHA256

019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a
SHA512

239ecf78c82c4fa1454dff14abc72a7d62f5ef8dce6643a96d4ad27e6f6cbae2ed5c0aa110e4741c3618350b9fb597eda61d1de15943ba65b76b8fbc5f8b3d94
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aj:BrBew72604doSw6ewI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85
PID 4796 wrote to memory of 4228	4796	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	85

C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
"C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4228

memory/4228-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4228-132-0x0000000000000000-mapping.dmp

Download
memory/4228-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4228-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4228-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4228-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download