0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c

Analysis

max time kernel
179s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 15:53

Target

0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
Size

1.2MB
MD5

3b4334bc65f81cf7e852244da9981bd0
SHA1

9a623875071e11c931f23eae5fd3a0a70b7e32ce
SHA256

0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c
SHA512

13265eb79fa54e0a1697a49122fcc4cf8f8d9bd57e48761cdd03f81f638a314c7f57109e2d7ecceef423daa9b656ee1ad2a8a34ba446f5c72a1c64bba1feafa1
SSDEEP

24576:tbkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42CL:CqvCEaRkca2Yb/3PmKxqS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4568	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
4568	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
4568	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
4568	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
4568	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84
PID 2164 wrote to memory of 4568	2164	0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe	84

C:\Users\Admin\AppData\Local\Temp\0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
"C:\Users\Admin\AppData\Local\Temp\0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\0b0de39ade0356e48f2fc00e338473b337c994d180723ab541879c9a3afbd26c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4568

memory/4568-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4568-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4568-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4568-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4568-137-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/4568-138-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download