390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:05

Target

390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
Size

1.5MB
MD5

640298568751b1dc12a0d226856cc6d0
SHA1

bc22a9929288efcd73cdbe65c95103ae25fac415
SHA256

390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7
SHA512

d057f1c3e218f8caba6d0f8a839e22dc505ce861e669b2cd768846d4656181c68c9c7a8876d221c6660fa1f7748edecf527f52e8fcf28f0e607c85fbdfa5c6c4
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+J:YIBfvMkrNrf0u3qdaNLgQWiO+p

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4548	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
4548	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
4548	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
4548	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
4548	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80
PID 4652 wrote to memory of 4548	4652	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	80

C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
"C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4548

memory/4548-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4548-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4548-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4548-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4548-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download