6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 11:05

Target

6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
Size

1.3MB
MD5

7dc8051b7303c0ab2c87b834bbaa21da
SHA1

7d461413b3f6f2f81393b275a6c27a314124e12a
SHA256

6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d
SHA512

605e7d3a08fd5c116e4458d9420cdb1ae1d1ff826dad18a8adcbbe2290b15f100868114172073279ebc05d7ea5ae49f8fb11ba7f6bad8c441c9a212623c0dfa4
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak3:zrKo4ZwCOnYjVmJPaM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3956	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
3956	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
3956	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
3956	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
3956	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85
PID 1284 wrote to memory of 3956	1284	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	85

C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
"C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3956

memory/3956-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3956-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3956-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3956-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3956-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3956-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download