6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 17:48

Target

6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
Size

1.5MB
MD5

9e551b69edcbae7179037ab5d690d1a8
SHA1

a467a0096deb4d11ef75a677a475bcd127c9043e
SHA256

6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4
SHA512

d36fa571367f07b09ca82296591a2e12cbc500d1921f4526dd1e9ec35ef4bbce885c4b4c9deb389a91fd785283f2c99c3d85054e18e054562b85443f0a9843c3
SSDEEP

24576:rPEzeDWtazKrcVWv+FjisSOZYjmOdXQ+ARZoQWnQUwMlds0VwI/9Mz:rIwwImsMqQA57oQWcGdsyG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4056	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
4056	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
4056	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
4056	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
4056	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84
PID 4224 wrote to memory of 4056	4224	6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe	84

C:\Users\Admin\AppData\Local\Temp\6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
"C:\Users\Admin\AppData\Local\Temp\6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\6f6c174a40529d5458343dd91a4f4bf8c0619bba44ed3a3351afbe0c96c55fe4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4056

memory/4056-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4056-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4056-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4056-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4056-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4056-138-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download