d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5

Analysis

max time kernel
165s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 19:57

Target

d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
Size

1.0MB
MD5

4167e275c9bfcc10905fa781540ecc1a
SHA1

b46cffb52ba996f8928f616defc573ecd6580d0f
SHA256

d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5
SHA512

b27577ab560a16b8205228f6be6cd44508cb86a90a7e368fe22a14221c40be38097fc9257224d8de03478627e22b5fb003e902b37bea7285455f435888210254
SSDEEP

24576:oJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpq:oWFPaXGalaCTt8XjwoGji8B

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4272 set thread context of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4940	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
4940	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
4940	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
4940	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
4940	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83
PID 4272 wrote to memory of 4940	4272	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	83

C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
"C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4940

memory/4940-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4940-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4940-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4940-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4940-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download