fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a

Analysis

max time kernel
168s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 02:40

Target

fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
Size

1.3MB
MD5

d1f4be47c41577e954d33fcee397742b
SHA1

382c487350330f5f3d9af3d6f6796a371e49500a
SHA256

fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a
SHA512

a811f221ffaa9e9fdce8c898f84dc267b93572897ec0ec078afb028a078ff827955fe1441f3c66d14042617857ddc18abc7cf545cab3e5d3d1bc645efc99c396
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakF:TrKo4ZwCOnYjVmJPaq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3120	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
3120	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
3120	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
3120	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
3120	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83
PID 1084 wrote to memory of 3120	1084	fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe	83

C:\Users\Admin\AppData\Local\Temp\fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
"C:\Users\Admin\AppData\Local\Temp\fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\fe411220e33bf3980b34a1dd623fdf686b6424785e312a7e85f4fc0593aafa3a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3120

memory/3120-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3120-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3120-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3120-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3120-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download