2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 15:12

Target

2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe
Size

1.3MB
MD5

7c3e04557983e039e7aee86c01a20bbf
SHA1

71dc80e57ab09e2ac2c3a157987b292f88253538
SHA256

2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352
SHA512

4e630da409c8cc6aaafa1d30acaf95e5024256cb598faea3fc1b3c2b576334f54b207a7a50908bd7cae06f2e1d1e2d34a89f3d410884a33926697709e484570b
SSDEEP

24576:JDASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfgl:OSQtk2zQytkgis6yxO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4148 set thread context of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83
PID 4148 wrote to memory of 4344	4148	2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe	83

C:\Users\Admin\AppData\Local\Temp\2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe
"C:\Users\Admin\AppData\Local\Temp\2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\2a392fe0687d62c31468449ac09b2d93dc0e43877b516434294def59228b7352.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4344

memory/4344-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4344-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4344-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4344-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4344-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download