0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2

Analysis

max time kernel
106s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:08

Target

0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
Size

1.5MB
MD5

a998dda69e4817c9afb5f2e7edefe926
SHA1

c5d71448c81261534673046908711db2030912dc
SHA256

0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2
SHA512

50f69815aed52f3ee976ba7ae1c324df09cc75f79531de5a0f150c1d1565319b1dbc09c9c1fa46974f7d6348c6fc3ba3486f89a5bd6ae86a2eed5370f8a4372d
SSDEEP

24576:i5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+Y:IIBfvMkrNrf0u3qdaNLgQWiO+4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1504	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
1504	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
1504	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
1504	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
1504	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82
PID 2532 wrote to memory of 1504	2532	0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe	82

C:\Users\Admin\AppData\Local\Temp\0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
"C:\Users\Admin\AppData\Local\Temp\0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\0f1cb3c4d66768bd69832f5f06bb61b95befecec32caa0738c236ddccd0b49f2.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1504

memory/1504-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1504-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1504-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1504-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1504-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download