d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5

Analysis

max time kernel
166s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 05:04

Target

d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
Size

1.3MB
MD5

a96db5d148f0b83714ebf762eff974cb
SHA1

5a6f94dc5e7e9bfa403f0155a534674c818abfc6
SHA256

d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5
SHA512

f9acd132edcff1b9db97524918377b9111c2da85b68e09405b1883b49ad1913c2a46bdb0a9747beb356a7caec5ccccdb9fe4b4462dc2bf7848e360853a943c69
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakA:TrKo4ZwCOnYjVmJPa/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2140	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
2140	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
2140	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
2140	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
2140	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82
PID 2316 wrote to memory of 2140	2316	d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe	82

C:\Users\Admin\AppData\Local\Temp\d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
"C:\Users\Admin\AppData\Local\Temp\d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\d6a5a130a7914a6b8ce72e7502feea6bab81d17765f3d906b9a29d3a44ba40a5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2140

memory/2140-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2140-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2140-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2140-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2140-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2140-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download