f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 17:55

Target

f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
Size

1.5MB
MD5

b4ae24ab9bc14d35b3f9cd7209554448
SHA1

9d2cc6c45aebba070010a92672c95fabf20f3125
SHA256

f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4
SHA512

ebb2b8dfd111a32f2ec78e2b4b593ee2a7fa9645e1f047dd8be06b9e5913e3b70b92c8233cc9e2401b71d5ae3a99c9e117bb515411bff52609a7b2c5df43049b
SSDEEP

24576:i5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+ap:IIBfvMkrNrf0u3qdaNLgQWiO+K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3028	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
3028	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
3028	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
3028	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
3028	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80
PID 1436 wrote to memory of 3028	1436	f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe	80

C:\Users\Admin\AppData\Local\Temp\f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
"C:\Users\Admin\AppData\Local\Temp\f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\f9fd9fba2d394201a63886db836e378b2a2073c93bcecc896234723fd2af4fd4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3028

memory/3028-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3028-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3028-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3028-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3028-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download