969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33

Analysis

max time kernel
156s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 20:10

Target

969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
Size

1.0MB
MD5

403b0e19e5a7dabcd71f52779af42017
SHA1

3b20c0dbf2be5531e85f99ee961ef5136fce6004
SHA256

969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33
SHA512

311b1253cdbde36970e02a12c98461491cee6c32e73a83b11a5f8b83e677e86bd4e1bf9a029f15e315c8c9fec4fc27c21bc6eeaa5e5cc3d150f6cda2bce83b16
SSDEEP

24576:oJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpF:oWFPaXGalaCTt8XjwoGji8y

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1004	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
1004	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
1004	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
1004	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
1004	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76
PID 2288 wrote to memory of 1004	2288	969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe	76

C:\Users\Admin\AppData\Local\Temp\969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
"C:\Users\Admin\AppData\Local\Temp\969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\969fc9cb6b6b9f4743c79a468127a2b97bb740305a675a4792ba2feabcec7e33.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1004

memory/1004-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1004-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1004-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1004-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1004-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download