fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 02:49

Target

fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
Size

1.3MB
MD5

562bf7a1ddacc306778dba5dbfb0a451
SHA1

119b9209cb7b874349e5d2b9a974c4e24a535f35
SHA256

fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e
SHA512

ab46589aca1ede21310d11d36cdabcca411b50d5c1be49c4f60791fc329c8f0a3feeba21266e9f0bb39f6aa465e5f6acf6aa73b32eccf22a538dd34e7bd9f8bd
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakq6:TrKo4ZwCOnYjVmJPau

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4000	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
4000	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
4000	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
4000	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
4000	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82
PID 4840 wrote to memory of 4000	4840	fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe	82

C:\Users\Admin\AppData\Local\Temp\fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
"C:\Users\Admin\AppData\Local\Temp\fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\fbabb3c737a30e1c29d7d5493518dbf6c7e2081e43daa9d898d1d4194cecc33e.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4000

memory/4000-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4000-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4000-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4000-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4000-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download