fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:44

Target

fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
Size

1.3MB
MD5

9cc6b9353c73d30bcf1162c41d17a61e
SHA1

28a800f3fe39fbb9548241fefb11ce82627ce85b
SHA256

fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3
SHA512

d64c04f40ef5c3e7a2697ed1723329a9be3f21f087a5f09e52fcb11c11809535d58ec1df368d7584bbda70b5b982d8e65006cb50318c47535b7715bd03e83e94
SSDEEP

24576:Aprt9au8OGecdnpCmHPaKkdxyHPHVs/twDy0YxbHcvvO484:AwdnBTkdx6HVs/+8xeX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4460	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
4460	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
4460	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
4460	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
4460	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83
PID 1960 wrote to memory of 4460	1960	fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe	83

C:\Users\Admin\AppData\Local\Temp\fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
"C:\Users\Admin\AppData\Local\Temp\fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\fb3181af1bd54fdce8e084c389510b7cc21fef208dcf2535714383768c13dad3.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4460

memory/4460-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4460-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4460-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4460-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4460-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4460-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download