49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 13:19

Target

49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
Size

1.1MB
MD5

889ceaaf80f52323ddfe49a3ab25eced
SHA1

001b67b1dc534b730fddcb3096f0d035c0ef3f40
SHA256

49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a
SHA512

8e50f5aeb3fa574597f3264b5dce58211eeaec55577e50e1a9ab30ad3606cafa3edbe6898c3a22f595934e07fb5e02aec7b7a86f2dbdc4143031f585c5c3699c
SSDEEP

24576:zjmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3rW:zqAtI704g/D3Tm03S

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4296 set thread context of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4688	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
4688	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
4688	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
4688	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
4688	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84
PID 4296 wrote to memory of 4688	4296	49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe	84

C:\Users\Admin\AppData\Local\Temp\49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
"C:\Users\Admin\AppData\Local\Temp\49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\49c580736036e567edf929508aecc93a7da21f834fea93ee287caf1d5d5fef2a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4688

memory/4688-133-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4688-134-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4688-135-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4688-136-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4688-137-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4688-138-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download