4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 20:30

Target

4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe
Size

1.0MB
MD5

111e90750edc300cae2f146e8d065ad5
SHA1

0ecc47b0dcd4e6657260d9dc94249fc78284b227
SHA256

4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230
SHA512

5f6801a7bcf744972d47aefe0a3294d9b8781342c5920de47e15c10f3e9b392d3ce71496396736378a07f271a2f4a496ac2db01d3fa1d928c8265dfae33f9812
SSDEEP

24576:oJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpg:oWFPaXGalaCTt8XjwoGji8H

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83
PID 3068 wrote to memory of 4920	3068	4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe	83

C:\Users\Admin\AppData\Local\Temp\4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe
"C:\Users\Admin\AppData\Local\Temp\4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\4301bb6b4afd4ffe57c95951c793fc642c4f383563c6743a154870539f66c230.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4920

memory/4920-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4920-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4920-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4920-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4920-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download