b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 07:17

Target

b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe
Size

1.3MB
MD5

8e8a95bf312dcd5c616c019bce81fb37
SHA1

c9784098127681e3888e9e68583528ac5a4613ed
SHA256

b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76
SHA512

6b61d317c9a9bdd2a368f5b59e8545cb68062c4aca2cc63712a78d7b1a5ad96a6b026ce9d7a54c7c90adaacc48847d9554987b14df060ebbd9245a8bbf97f767
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakl:TrKo4ZwCOnYjVmJPaK

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4876 set thread context of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84
PID 4876 wrote to memory of 640	4876	b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe	84

C:\Users\Admin\AppData\Local\Temp\b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe
"C:\Users\Admin\AppData\Local\Temp\b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\b139ff3356973ead90c34221328b7ddd1c84de1a38a7266737ab81664b91fa76.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:640

memory/640-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/640-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/640-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/640-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/640-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/640-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download