72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:06

Target

72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
Size

1.3MB
MD5

f186e8fecd2cc03537bcf84b6ff31ec1
SHA1

94346675fcab5c3676138dcc01e8ec03c3c44f7b
SHA256

72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea
SHA512

4995697efc69e23796905fedbe1a0087fd552d2cb8033e70b1eda7e2d7fca8d6f0349a1619a043a659ace38d44731d871d36e41735494892bc5b0e68746fd067
SSDEEP

24576:KXO93poEu4pCkao1bNQfSyNGXTYGwwKCWiBe+I351KDsTXY8vZ6Qek:KMZoANNbyNGjW8u5MsTXY8vfl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4856	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
4856	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
4856	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
4856	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
4856	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84
PID 3480 wrote to memory of 4856	3480	72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe	84

C:\Users\Admin\AppData\Local\Temp\72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
"C:\Users\Admin\AppData\Local\Temp\72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\72743132d60f9bd259ce6b353e8fa2af77795d279094db4174d8310b11b1feea.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4856

memory/4856-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4856-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4856-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4856-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4856-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4856-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download