bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 06:34

Target

bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe
Size

1.3MB
MD5

841fd5a030464c2748f7fac53f693ac5
SHA1

1d48f578559101348f5203a1f02e85436fee44fe
SHA256

bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522
SHA512

46cfa05e090ee2f528522ae964403cb657a1b764f0beb63b8fcd25c29a34fc97e44f4b1a05a94e2292d987392fcfb6cf13c47a1aa148dad42add62792860c371
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakY:jrKo4ZwCOnYjVmJPa3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4408 set thread context of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81
PID 4408 wrote to memory of 3036	4408	bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe	81

C:\Users\Admin\AppData\Local\Temp\bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe
"C:\Users\Admin\AppData\Local\Temp\bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\bcc80007181aa3b7052281cfd76d299d21482042ea21e507f13bc8b5be739522.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3036

memory/3036-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3036-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3036-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3036-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3036-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download