228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a

Analysis

max time kernel
61s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:42

Target

228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
Size

1.2MB
MD5

6445dbce4bf19f4581df6600c5e5d7d6
SHA1

f71fbdb03298651b8bbc6fd76db05b7c6331e53e
SHA256

228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a
SHA512

6a31a5268f9e56fdd42b937c5122fe372caa24863ec3d3d0d8221409d8f6b6e31a74d8954ec7202eb3f39ed68934c275081b5f0a3e0fb0e4eb81d1756ccdc67a
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mX:6MdkS6IsXkRX0bQEgYe709hl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3012	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
3012	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
3012	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
3012	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
3012	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82
PID 400 wrote to memory of 3012	400	228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe	82

C:\Users\Admin\AppData\Local\Temp\228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
"C:\Users\Admin\AppData\Local\Temp\228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\228d3b249b5126d8c8fb6645132ed14bbd5a05ad5ac7da2d7b664664b9d57b4a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3012

memory/3012-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3012-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3012-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3012-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3012-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download