6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 11:22

Target

6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
Size

1.3MB
MD5

7ecf30cdb71139dd6a0761e086f5ea76
SHA1

65ff25d87312c7fae6a11940ce307f8897b329ad
SHA256

6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161
SHA512

c9e55c8237617f1e8691c42dbe866ebfbd035bb9644dd5ea96d53c21a65ef151b218cbc3f6311a8d991b5d2d7c72081eac961ea4f497f22f43a41538ff444b62
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaka:brKo4ZwCOnYjVmJPaN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2548	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
2548	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
2548	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
2548	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
2548	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82
PID 1276 wrote to memory of 2548	1276	6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe	82

C:\Users\Admin\AppData\Local\Temp\6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
"C:\Users\Admin\AppData\Local\Temp\6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\6b1840795d2d0dde6a2142ff6d3e2e0af718d0d0b702a1fbdfe7c21b7020b161.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2548

memory/2548-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2548-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download