373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 14:24

Target

373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
Size

1.3MB
MD5

d5b9e883419a9f423926383bf93244d2
SHA1

1a527058ea3c13c598d6eacd76ab112d8abcafe5
SHA256

373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870
SHA512

205a92f08bb56a8890451ace96fd098bc060935e6eb72fb697b37460740cab0ec539684c3d7ed54c21d978bba4d7882a75da92c04fe7a0755691e056fd61801e
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaks:7rKo4ZwCOnYjVmJPaD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2864 set thread context of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
992	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
992	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
992	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
992	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
992	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81
PID 2864 wrote to memory of 992	2864	373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe	81

C:\Users\Admin\AppData\Local\Temp\373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
"C:\Users\Admin\AppData\Local\Temp\373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\373c291f22291025e4ec099ccfe641ed7a9b8977f13fe323256e9cd5cebd5870.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:992

memory/992-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/992-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/992-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/992-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/992-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download