65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 11:41

Target

65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe
Size

1.3MB
MD5

e3b9fcb4a0ae1f02abcafd5a5f5b9b9a
SHA1

6799890cb04c8c611dffa50e8d621af16a583161
SHA256

65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067
SHA512

ad7e2f87d3317961f43b7869900e1a3004a9d5e405ffc82d9098dccfebfcdea761af6367a245a5551b4ba59ab3eb8880d202ff57cd262d27d73a83724f9cafcf
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak5:zrKo4ZwCOnYjVmJPaW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 488 set thread context of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78
PID 488 wrote to memory of 4912	488	65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe	78

C:\Users\Admin\AppData\Local\Temp\65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe
"C:\Users\Admin\AppData\Local\Temp\65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\65bb027908d82effc613b08b6a4a0f85b0e8797f3302036b9835b01effe63067.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4912

memory/4912-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4912-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4912-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4912-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4912-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download