aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 07:39

Target

aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe
Size

1.3MB
MD5

6885bd2664acc40f5f9b7e72b3f2b2ca
SHA1

0aa3a3088e3cb6afad893efcd3844dcc5b340283
SHA256

aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24
SHA512

274fc44c933a03ac19b3aee769046ee48dd2a3f848e4e95ccc99f0613cbc839d88805e2e21705b8e78d9dbb78c87f187a0f1f2fbef51e8dcaf29350ba449cdf5
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakt:brKo4ZwCOnYjVmJPaS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4440 set thread context of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83
PID 4440 wrote to memory of 4848	4440	aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe	83

C:\Users\Admin\AppData\Local\Temp\aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe
"C:\Users\Admin\AppData\Local\Temp\aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\aafbf1520e2f945f36b8e03c884a78987f9c114c8f631b896720843492e02b24.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4848

memory/4848-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4848-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4848-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4848-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4848-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4848-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download