1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 23:41

Target

1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
Size

1.3MB
MD5

11e7eacc85542b25658c85f3de9517cc
SHA1

fff7ea7bd81b57d3977f921cb7bea3a87fbcacd6
SHA256

1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887
SHA512

c30af23ddecb34d178db33e7a79c3da0e15a7eebccd04e45567f5fc03c87de74aa9dc14061b9a65c0798917806ef670eea22b04477a96a744e889a8b03e6e64c
SSDEEP

24576:4OiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9F:Ri1DWLFP53UGe76x0ZUphdt2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1084	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
1084	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
1084	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
1084	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
1084	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83
PID 4776 wrote to memory of 1084	4776	1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe	83

C:\Users\Admin\AppData\Local\Temp\1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
"C:\Users\Admin\AppData\Local\Temp\1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\1a2b615ba92d67119921465b54b691cbb40c7c07de9c1874a54ad75be7dec887.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1084

memory/1084-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1084-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1084-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1084-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1084-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download