2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 15:02

Target

2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe
Size

1.3MB
MD5

acc46e14bf3b17060cde3d7b3f46ee88
SHA1

dc4db4fd19bc6053fe7d16edfa770befffeeb627
SHA256

2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5
SHA512

06c739bfd7f346db24d6a17b3f0acb211c563e9f7587d48966f069e208978ebc356b436423615c346bdb8242a24e4ab40fca50c14afffaab0d74de127a92f233
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakw:zrKo4ZwCOnYjVmJPar

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84
PID 4836 wrote to memory of 4256	4836	2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe	84

C:\Users\Admin\AppData\Local\Temp\2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe
"C:\Users\Admin\AppData\Local\Temp\2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\2cf97f1205e1114ae5356020220695023efc81fb7fc4dc3277453e98b1f9aaf5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4256

memory/4256-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4256-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4256-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4256-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4256-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download