f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57

Analysis

max time kernel
160s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 03:19

Target

f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
Size

1.3MB
MD5

99425725d5c67d67a87122f09088b080
SHA1

8b39a43e3e5e832d18a0d5c96881ec652dd3dc5c
SHA256

f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57
SHA512

0ba2d428f71a851cf3caac2abd79694ebbe0480c50916b8023cc14836d5a72186c5b323de1d6c863ea9eb1b27347601377728bc3da0e98def58e1422c8b941aa
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakZ:brKo4ZwCOnYjVmJPa6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4576	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
4576	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
4576	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
4576	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
4576	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84
PID 2940 wrote to memory of 4576	2940	f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe	84

C:\Users\Admin\AppData\Local\Temp\f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
"C:\Users\Admin\AppData\Local\Temp\f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\f33f206ed442f07bc56c4b15c3da652bdb88b7a7e5503fe02e3d607248432d57.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4576

memory/4576-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4576-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4576-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4576-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4576-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download