ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0

Analysis

max time kernel
177s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 20:02

Target

ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
Size

1.0MB
MD5

76da1f6da8e5a89f7661c4298067e766
SHA1

726c9f30383b1db729a774d313fed0e015dd8f67
SHA256

ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0
SHA512

65e03a4a874a3f4ad2e40074b600a6e93337e5cfb5da6ef0b331a7ce94dc50cc030ea2e492c2cbfbb07e15adc0be4328785bf0d700efe2b46c33814066d3991b
SSDEEP

24576:fJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpX:fWFPaXGalaCTt8XjwoGji88

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3064	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
3064	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
3064	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
3064	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
3064	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84
PID 1872 wrote to memory of 3064	1872	ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe	84

C:\Users\Admin\AppData\Local\Temp\ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
"C:\Users\Admin\AppData\Local\Temp\ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\ba666eb1f9c5ebf970e542bd1403735e2e63b1cdcb93d55a3e7b5321b245bed0.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3064

memory/3064-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3064-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3064-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3064-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3064-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download