39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d

Analysis

max time kernel
180s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:40

Target

39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
Size

1.3MB
MD5

a8d9cef9bf7d9bcf7834631dbfabc48a
SHA1

3d6bbccd2737d99403556250452bec24419420ba
SHA256

39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d
SHA512

43fbb0174c2825837393d42e8db3abd301a48c33c052cd22f7453e5da8be3f65843c965c4e6aead34e0f7190ee6e467a42a4115f80f24753f6c501c110763c86
SSDEEP

24576:SGjJZtAXaMb5YpCCNAfGU64giomYhXlZwVBhVS+JbIHICWKotTn+G:SGNZpbmfLRgioDXz+BhA3SvVnP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4008	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
4008	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
4008	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
4008	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
4008	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83
PID 1040 wrote to memory of 4008	1040	39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe	83

C:\Users\Admin\AppData\Local\Temp\39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
"C:\Users\Admin\AppData\Local\Temp\39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\39b13321b777ca719c201fffc3d5671e9feb75535c7fd40ccad9e1b4694fee1d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4008

memory/4008-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4008-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4008-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4008-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4008-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4008-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download