b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a

Analysis

max time kernel
167s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 20:04

Target

b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
Size

1.0MB
MD5

a558a8f95a8e4302a8b76479abff5aed
SHA1

5245940a317ff7186fd38f452287b5a9ec0ad9f5
SHA256

b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a
SHA512

1561c9e37d53f9fe45600f3495d0ab7cd88b8046e10a52dfbfe4e72416d4485ccd1c35f222077ecb631abab9b0a1aae246efd850c5e6c6e1ee557f57a6f2326e
SSDEEP

24576:/J0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpj:/WFPaXGalaCTt8XjwoGji8U

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2628	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
2628	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
2628	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
2628	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
2628	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84
PID 3000 wrote to memory of 2628	3000	b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe	84

C:\Users\Admin\AppData\Local\Temp\b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
"C:\Users\Admin\AppData\Local\Temp\b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\b325767244817376a5e53c6b4901eeaf3b0ec2b41ea0f031fdf0a522f2cb464a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2628

memory/2628-132-0x0000000000000000-mapping.dmp

Download
memory/2628-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2628-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2628-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2628-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2628-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download