bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 06:38

Target

bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
Size

1.3MB
MD5

2c96d6ef3bc448a47f7ac6198096d800
SHA1

89acd9a41d8b9e83d01dd1a2c1ed655c1c53b224
SHA256

bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286
SHA512

854d69e6dbeadbe523d553eb1467c39905d14dcf884cb5312b4400376e949eb95522a447d125cec678d3a679978b3b576a3977d90f5abfc637bf55a16554911c
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak5:zrKo4ZwCOnYjVmJPaO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4756	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
4756	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
4756	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
4756	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
4756	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85
PID 3176 wrote to memory of 4756	3176	bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe	85

C:\Users\Admin\AppData\Local\Temp\bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
"C:\Users\Admin\AppData\Local\Temp\bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\bb91457b3a9d8d800c6befdc6308036c729471d231f802cfcdfb7267da3c9286.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4756

memory/4756-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4756-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4756-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4756-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4756-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4756-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download