460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 13:32

Target

460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
Size

1.3MB
MD5

b0f664fc69a1ef6d30c34a25a2c4c550
SHA1

43615b5ef1979b7f5a30a28edfb5f3a7b195f928
SHA256

460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3
SHA512

488373f3c450d27f6a57c40b702fe05a1f486a3df5d3d2f52775d74226868a7775a223fc425d879cd72da30ef0c12c31f7dcee16cccfc0250b191f450095b716
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaks:zrKo4ZwCOnYjVmJPav

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4828	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
4828	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
4828	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
4828	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
4828	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79
PID 5048 wrote to memory of 4828	5048	460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe	79

C:\Users\Admin\AppData\Local\Temp\460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
"C:\Users\Admin\AppData\Local\Temp\460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\460d9b1d43e5c421a4cc3393ffda5d66f5dbb2e677eff2dbdff5ccc82c065ac3.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4828

memory/4828-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4828-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4828-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4828-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4828-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download