ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 06:43

Target

ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
Size

1.3MB
MD5

6e0e901a5d01f0f05e96fceb5b17d5d6
SHA1

b72678fd4b2c180e63b0eac8d2907327623fbd0b
SHA256

ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d
SHA512

cc702640723874f0cf6e4b4e4384975616365092108b381e2bde0ae39ee379b4f9909a77cd540037d099aa6d7fe6a6ef82149fa910ef33bfca663cf4e88adc96
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakB:jrKo4ZwCOnYjVmJPam

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
392	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
392	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
392	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
392	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
392	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84
PID 4500 wrote to memory of 392	4500	ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe	84

C:\Users\Admin\AppData\Local\Temp\ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
"C:\Users\Admin\AppData\Local\Temp\ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\ba2edbf7c7a6948aef225adbcb939a6069273ba803aaab37a1caaae900ffcf9d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:392

memory/392-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/392-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/392-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/392-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/392-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download