0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 16:43

Target

0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
Size

1.3MB
MD5

d92c917765e1dc2c62784a05a1d8b1d6
SHA1

0da7c4ad7618c73519c4bd63ecbafff555968696
SHA256

0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d
SHA512

798fae5de7ccac244e9cc4db8cc1a02c290b5ccdfb643184719f8e6c40bb4328d99ab7049654c487dca6248b5f0236a44fe7f232da61b3e0d35d5e84760808b1
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakv:zrKo4ZwCOnYjVmJPa4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4808 set thread context of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3796	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
3796	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
3796	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
3796	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
3796	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80
PID 4808 wrote to memory of 3796	4808	0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe	80

C:\Users\Admin\AppData\Local\Temp\0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
"C:\Users\Admin\AppData\Local\Temp\0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\0f8e58e805aaee8cb65c1c83d292264ce7ba53272148e1c408a02c29ded9755d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3796

memory/3796-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3796-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3796-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3796-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3796-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download