211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39

Analysis

max time kernel
68s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 18:21

Target

211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
Size

1.2MB
MD5

add6e79574d44700a9d254f4bf42ddb1
SHA1

e88eafe06fd7264712e785615a48321b8cd51015
SHA256

211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39
SHA512

cb374c9c871d0a7e8610f14a742f3765057d3aed71df96e56224f62a178803de8ea4a780166edbdc37337d694e156d86148886dab037cd2b413cc2b19723d3cc
SSDEEP

24576:IXIe1k135jsYx0ySMIAA/9I+8jhIFqpmMcZIKxKfN:IXfyFBIAupqpm1as0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3704 set thread context of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4100	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
4100	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
4100	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
4100	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
4100	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82
PID 3704 wrote to memory of 4100	3704	211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe	82

C:\Users\Admin\AppData\Local\Temp\211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
"C:\Users\Admin\AppData\Local\Temp\211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\211fc5d312bb15da5878804138cf4ded5e3a4611ea1595d85b00a2c52c444f39.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4100

memory/4100-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4100-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4100-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4100-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4100-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4100-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download