9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 08:31

Target

9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe
Size

1.3MB
MD5

68e2410029b9018d9a39af0cb2f53270
SHA1

06415acdb7c7fe4f33894a27478059e3372191c0
SHA256

9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499
SHA512

1872f2cc9cbd5ecae78e67b42d825ebae70e964d59f78076786effaef3a4f66b0c54359b6f7f0f774cfacabc8ee222d538c50c714a56b26f0452f0e3ed5b0c4f
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:zrKo4ZwCOnYjVmJPaV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83
PID 4992 wrote to memory of 868	4992	9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe	83

C:\Users\Admin\AppData\Local\Temp\9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe
"C:\Users\Admin\AppData\Local\Temp\9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Temp\9baa14c004025a5420d053fc35231c52922334e23e8ef10520745157ffe1f499.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:868

memory/868-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download