d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 17:44

Target

d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
Size

1.5MB
MD5

a077a8898c45671c641160759c4e25cb
SHA1

4558f604d88c87f4a67ad2042a42856a6b13ba46
SHA256

d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c
SHA512

8c7919865717b31b3753ead879c60c6cbbd2f866f1351c0aceba3eaf4a46e88c4b4bbadfaa61ed8857866c5a6f86c913a41962a58902d765b266bd67ec6f836b
SSDEEP

24576:rPEzeDWtazKrcVWv+FjisSOZYjmOdXQ+ARZoQWnQUwMlds0VwI/9M/:rIwwImsMqQA57oQWcGdsy2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5016	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
5016	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
5016	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
5016	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
5016	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82
PID 5096 wrote to memory of 5016	5096	d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe	82

C:\Users\Admin\AppData\Local\Temp\d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
"C:\Users\Admin\AppData\Local\Temp\d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\d8afa68ed985f4080211f6e4e563f31daefff375399c3c2cafc6c7e6c82a5f1c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5016

memory/5016-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5016-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5016-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5016-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5016-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download