141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 18:42

Target

141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
Size

1.2MB
MD5

225cde8d6c10690d126300ade7d6fd2b
SHA1

2c6994039435e2c4893cb3448db98cc4c1d1b51e
SHA256

141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949
SHA512

977a5f358065521656b72db7f98133ddedc1fb42bbfecd6b5942a195d5ae467ee556612737bc842e4bc5610a36f507fd4d190a34cb85dfc482cdde7b518eb2fd
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68m7:6MdkS6IsXkRX0bQEgYe709hV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2136	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
2136	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
2136	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
2136	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
2136	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79
PID 4736 wrote to memory of 2136	4736	141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe	79

C:\Users\Admin\AppData\Local\Temp\141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
"C:\Users\Admin\AppData\Local\Temp\141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\141b2faaa034a67a1c99738e0ff8090f96a349265fa1ba28445179afafa51949.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2136

memory/2136-132-0x0000000000000000-mapping.dmp

Download
memory/2136-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2136-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2136-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2136-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2136-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download