3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108

Analysis

max time kernel
173s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 13:54

Target

3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
Size

1.3MB
MD5

9b7953f83ffeb8354ca172af618f8121
SHA1

ca3aa80725462fe7d757831581062f6fec5af604
SHA256

3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108
SHA512

53647b6d0a52476bc4ed966078f70141305f5fea04fa31efd3a9020fec356ac4dfab0294bd61972d46e64e2621f0e3272f4b5d87fa7f67cdf4135d7a6b8e9f0d
SSDEEP

24576:YOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9U:xi1DWLFP53UGe76x0ZUphdtj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4400	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
4400	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
4400	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
4400	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
4400	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82
PID 4948 wrote to memory of 4400	4948	3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe	82

C:\Users\Admin\AppData\Local\Temp\3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
"C:\Users\Admin\AppData\Local\Temp\3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\3fc0face4bf18fdf3306ebec8b58ae803daff6be6a79df2f476bd3adf0c0d108.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4400

memory/4400-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4400-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4400-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4400-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4400-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download