385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 14:20

Target

385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
Size

1.3MB
MD5

e4650e8b48dabab15fbd689ec99316b4
SHA1

0c54f8809342858f843ec4500f46dc4b2341455a
SHA256

385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9
SHA512

b5bf282052b28d5590ae7103ee5645c081d838c981dab825477dd5522d80fbcb32dad85d685307aca238cf110114428122be0d0a667677df89e8eaa6ef823632
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakW:zrKo4ZwCOnYjVmJPah

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2248	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
2248	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
2248	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
2248	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
2248	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82
PID 640 wrote to memory of 2248	640	385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe	82

C:\Users\Admin\AppData\Local\Temp\385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
"C:\Users\Admin\AppData\Local\Temp\385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\385cdb78af49c31e369d279106cfbe0f59f17462da42bb1a86783f701724fdc9.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2248

memory/2248-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2248-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2248-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2248-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2248-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2248-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download