8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2

Analysis

max time kernel
159s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 09:18

Target

8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe
Size

1.3MB
MD5

880dbe990a688ab37ec655e0a62504bd
SHA1

d1f612e3ede190cbf93cbb5e11725c41bd8afe7c
SHA256

8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2
SHA512

3bad84cd48ce772eba87354c465a1b9026ac1dbda81527da00c7523bcff52c8194b99b58f149971d79f0bcca62d780c4a09a9e7e7429e5d200992869a79e7b69
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84
PID 2632 wrote to memory of 4356	2632	8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe	84

C:\Users\Admin\AppData\Local\Temp\8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe
"C:\Users\Admin\AppData\Local\Temp\8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\8f0a4a2b817b6114682d7d430a8609240f7f548e97918df93c6f334047254be2.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4356

memory/4356-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4356-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4356-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4356-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4356-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download