2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 15:07

Target

2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
Size

1.3MB
MD5

a574619f1ad164ed8cf975433957ff14
SHA1

706b799e62191b86f88db9a849ac16ea4779c1f5
SHA256

2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10
SHA512

65d50084e61bcce68d86b5d302b193b9d8a1fe41e40e1214ce4c27c21cce3c0a5e3a6fa9e343203d6d5b901d558d216ca1d39a8edd5d4cdb536ff4b2288df490
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakD:zrKo4ZwCOnYjVmJPaE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3928	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
3928	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
3928	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
3928	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
3928	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80
PID 4824 wrote to memory of 3928	4824	2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe	80

C:\Users\Admin\AppData\Local\Temp\2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
"C:\Users\Admin\AppData\Local\Temp\2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\2b8c5e96aac67447b60fcf4d965b6e554b61d25c0a73d0dd1f1fb223956cbb10.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3928

memory/3928-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3928-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3928-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3928-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3928-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download