960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:30

Target

960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
Size

1.3MB
MD5

18a2267c1b8edb7f63bc67cf947031e9
SHA1

017961115ce4be1911425f24712761f02226d01d
SHA256

960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf
SHA512

3458430df099f7d5e6dc530fa903c20706949f198a4e6695d74bd5fcfc911cfdd04b5f72480e7b7e09f659855dacf080214d0941a78abe598432adcb4f7dd390
SSDEEP

24576:zGjJZtAXaMb5YpCCNAfGU64giomYhXlZwVBhVS+JbIHICWKotTn+xk:zGNZpbmfLRgioDXz+BhA3SvVnuk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3128	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
3128	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
3128	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
3128	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
3128	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80
PID 1692 wrote to memory of 3128	1692	960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe	80

C:\Users\Admin\AppData\Local\Temp\960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
"C:\Users\Admin\AppData\Local\Temp\960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\960fa54faaf5795809b1821ebb9fad384d109b539c18e04d809c92df480321cf.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3128

memory/3128-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3128-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3128-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3128-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3128-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download