f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498

Analysis

max time kernel
170s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 20:53

Target

f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
Size

1.4MB
MD5

49c36d44bad21dc87f350a08574d2578
SHA1

001f897e070a683ca4a7bccee1e5b5a834551a80
SHA256

f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498
SHA512

1de8197a9788efcbd9299ab2e181773102da62de1bbb38563dfd62399a9d09bb9870ddddeb9c5242ef97da30eb12e745bb25102e36f56841ac005f2e3a58bab2
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ao:BrBew72604doSw6ew3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1420	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
1420	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
1420	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
1420	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
1420	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83
PID 2076 wrote to memory of 1420	2076	f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe	83

C:\Users\Admin\AppData\Local\Temp\f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
"C:\Users\Admin\AppData\Local\Temp\f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\f401686fa3c91a9998b9a2ce49b87817f54f837ccc08ea303a1307dac78a9498.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1420

memory/1420-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1420-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1420-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1420-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1420-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download