65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0

Analysis

max time kernel
116s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 11:40

Target

65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
Size

1.3MB
MD5

0c223cc9b1f3a02a1ea9c27363a1010b
SHA1

b04ad3b83ff4957127d85d9477906a29be6d2206
SHA256

65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0
SHA512

79f7f5fd57b9b506e5f2c9a378b537e383da1decd88aa124d5bf00355ea6bf9c82b3027807e9bbc14878071ab9ad5ba7e517424f4b1237c339a38cd9f93a212f
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakN:TrKo4ZwCOnYjVmJPaO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1548	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
1548	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
1548	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
1548	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
1548	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80
PID 4352 wrote to memory of 1548	4352	65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe	80

C:\Users\Admin\AppData\Local\Temp\65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
"C:\Users\Admin\AppData\Local\Temp\65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\65d1336f04c9928fdd5b3d6d7dbcdfc117daa3c4a34ab928fbbc99ec3121bce0.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1548

memory/1548-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1548-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1548-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1548-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1548-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1548-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download