f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 03:27

Target

f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
Size

1.3MB
MD5

6665dd4ec17ce8ec7f75cff8535fc8eb
SHA1

a967561a879852f45b119708cce4884d14575b51
SHA256

f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4
SHA512

c43bb38949512d0c8b0375e423412f63bb35021a53f1c4d796e573860d5ef865f5b1340777a9dd306541736b846dfa58531ad1169010849b356dc77b07c67b3b
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakI:zrKo4ZwCOnYjVmJPa7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4612 set thread context of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3060	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
3060	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
3060	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
3060	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
3060	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81
PID 4612 wrote to memory of 3060	4612	f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe	81

C:\Users\Admin\AppData\Local\Temp\f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
"C:\Users\Admin\AppData\Local\Temp\f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\f1419bcc4e02191bb59bc74f1e00ea5bc6e70d9c363d2c26465328639e5d05f4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3060

memory/3060-132-0x0000000000000000-mapping.dmp

Download
memory/3060-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3060-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3060-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3060-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3060-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3060-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download