18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 20:40

Target

18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
Size

1.0MB
MD5

66fb90f11303fe9039b3fc154e2f29d8
SHA1

2976244bc566415699dd5a6efeb055ab000c18c2
SHA256

18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a
SHA512

89cd8b12bff2762243430fb5034c0ba6fd265fb70857157263c69ba816be2717a359c108b44ac52eb069835b4e17c427110859a41e570923d45debdbfa6d2986
SSDEEP

24576:rJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlp:rWFPaXGalaCTt8XjwoGji8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4880 set thread context of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
760	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
760	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
760	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
760	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
760	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84
PID 4880 wrote to memory of 760	4880	18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe	84

C:\Users\Admin\AppData\Local\Temp\18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
"C:\Users\Admin\AppData\Local\Temp\18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\18b6df6f283582bcd309ce3051bf68bb56c02ae9a7fb5932c36d74f1c2a5176a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:760

memory/760-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/760-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/760-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/760-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/760-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download