736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c

Analysis

max time kernel
132s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 10:52

Target

736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
Size

1.3MB
MD5

36204ab832f22761332c109b9bec5884
SHA1

0bc13e5296ba58cab56f517fc7b1b4b1ea80227c
SHA256

736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c
SHA512

749d13e0ffa1953a8ed8085966d9a241128339a820807700d41a42886abede40f642c64c72292abbace1e28d9b4d2f1fdbf159e68ee87d08b0f14c88a82c677d
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:brKo4ZwCOnYjVmJPau

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3568 set thread context of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3924	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
3924	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
3924	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
3924	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
3924	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82
PID 3568 wrote to memory of 3924	3568	736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe	82

C:\Users\Admin\AppData\Local\Temp\736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
"C:\Users\Admin\AppData\Local\Temp\736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\736a5ac4a1a7969bc2b093e5ec5a8bf2a1f5fe2e682d2be1a11bfc304e854a7c.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3924

memory/3924-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3924-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3924-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3924-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3924-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3924-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download