5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 12:55

Target

5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe
Size

1.3MB
MD5

d70d15b79b7356578d9621ce5cdcbdf6
SHA1

cf7c1c90884ab1e70e6c1b148caa71cca48a6a17
SHA256

5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d
SHA512

d4e298d1524a164d6636df69e72bd4fc3ebb8c6ce29273e520003aafc6f84e8327a1be1e07b97440a45ba1a4a3f6019d78a07f5f139e9cb49d81bc0f5aa4133a
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:jrKo4ZwCOnYjVmJPa+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81
PID 2088 wrote to memory of 3068	2088	5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe	81

C:\Users\Admin\AppData\Local\Temp\5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe
"C:\Users\Admin\AppData\Local\Temp\5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\5068619b138c8d06565c0bb34ff2631a79ea342ba55d6fca25511e96599cc26d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3068

memory/3068-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3068-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download