91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 09:08

Target

91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
Size

1.3MB
MD5

b2c3af33b7f8f7db8137e73a53e094e7
SHA1

36fd8726334c64c26e199c06c92d0df282e5e2ee
SHA256

91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3
SHA512

5b55e40c32426e033b4a896ac846190524571a19a69a485d009fbf3f98e764ff58806e0552b8a24893486f72ffc17ac95693cfb64a800efaf4d3e4b65f8f9a77
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakY:zrKo4ZwCOnYjVmJPaH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3052	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
3052	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
3052	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
3052	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
3052	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79
PID 4816 wrote to memory of 3052	4816	91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe	79

C:\Users\Admin\AppData\Local\Temp\91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
"C:\Users\Admin\AppData\Local\Temp\91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\91a465f7634992e47e51523da38c62ecfb8f7d15e70cdd5a76908441a008dad3.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3052

memory/3052-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3052-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3052-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3052-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3052-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3052-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download