1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:14

Target

1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
Size

1.2MB
MD5

31e979076ff16d405694c2af781c6fdb
SHA1

bdeb276f3d6494cf07e11850542743142792f3c2
SHA256

1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c
SHA512

e3d5436853670f15eafd0edc7bdfae13044216642a08c5f118d19428a20118f723fc558ce1403e39f9d673056370be6b037bd91b040d933889cee7888f601f46
SSDEEP

24576:J8Ax9GLS59Q2SQUVqyeFtBJepApojDkfW/1RJMGdmXS:h955i2S5VFIBJewerJMkmi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1468	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
1468	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
1468	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
1468	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
1468	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84
PID 1252 wrote to memory of 1468	1252	1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe	84

C:\Users\Admin\AppData\Local\Temp\1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
"C:\Users\Admin\AppData\Local\Temp\1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\1cbaeeab2cc8b26c0e5b6d55fb01f4b13170af821ff7059c86bed2de3c960a2c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1468

memory/1468-134-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1468-133-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1468-135-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1468-136-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1468-137-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download