013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 18:08

Target

013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe
Size

1.5MB
MD5

9e0bb357071d20565686f10b2fbc6839
SHA1

4066dda012ded4430e75af7b94941494668447c9
SHA256

013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269
SHA512

3814ecba0f68e9df077742687db70a6e4310885c786ca35d3e5de1b498b3a9c230eac98e3a256021270080d28e7a11aa238cf4006dda2859f06f0b085bad10ab
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+C:YIBfvMkrNrf0u3qdaNLgQWiO+i

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80
PID 3444 wrote to memory of 4960	3444	013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe	80

C:\Users\Admin\AppData\Local\Temp\013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe
"C:\Users\Admin\AppData\Local\Temp\013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\013f9d61b23430a846b061eb511792b902050f205293c48471625f1813215269.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4960

memory/4960-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4960-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4960-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4960-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4960-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download