78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:33

Target

78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
Size

1.2MB
MD5

9c16aad25142d989236d636eea481185
SHA1

7f81779e99601802bfb129be992119ab5800af99
SHA256

78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b
SHA512

41c65fb267f7179ab2db15bc26faff336d48edee315965701bf35528a63f8f54bf917dad4e5b45ca730fb786afb8a04a823096d6ee5b138057eb61a396f589bc
SSDEEP

24576:aMdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mL:aMdkS6IsXkRX0bQEgYe709hR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3648 set thread context of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2144	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
2144	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
2144	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
2144	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
2144	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79
PID 3648 wrote to memory of 2144	3648	78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe	79

C:\Users\Admin\AppData\Local\Temp\78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
"C:\Users\Admin\AppData\Local\Temp\78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\78a3efa64778020acd30653151218441479a88bbf6d69ed3aa4e8e7f4ff35c4b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2144

memory/2144-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2144-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2144-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2144-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2144-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download