ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1

Analysis

max time kernel
159s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 07:38

Target

ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
Size

1.3MB
MD5

ab795080cd1b22d056a4dae3cd2240d6
SHA1

e5374f8ae092e969298903e4a0e8578ada5b4412
SHA256

ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1
SHA512

47dcc44762c326ae9b0e518e89b9505bd401390069a9b11cf1b9248b21ac8939362ed13a8e4b2f1339ac0a9cdbc43174242e55c6720222ab63e9b29e0cdb76db
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:7rKo4ZwCOnYjVmJPaI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4068	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
4068	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
4068	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
4068	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
4068	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82
PID 2040 wrote to memory of 4068	2040	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	82

C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
"C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4068

memory/4068-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4068-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4068-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4068-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4068-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download