af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Target

af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
Size

200KB
MD5

1a6958de8fae26b22c38a93dacc06196
SHA1

c7928373754103a6aecc6db7d66885f780940d47
SHA256

af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145
SHA512

be31fb494338cc5dfd90b7b99c31da585e20e73bccd8fa4dc154e237b44b914223d045587b186bbc6a6ce57deeae70f781c51bb92dd06953cb61b8075d3ab514
SSDEEP

3072:RqyJhVQ9jyBCSxcOV0ZFqqb1pv3ZPoI/JdCgl+Kx/7BEJQZoomnnNtZ4:Xs+BcOV0rqqhR3VoI/fCgbx7BEJQ0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

description	pid	process	target process
PID 4284 set thread context of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

pid process

4284 af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

pid	process
4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

description	pid	process	target process
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
PID 4284 wrote to memory of 4608	4284	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe	af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe

C:\Users\Admin\AppData\Local\Temp\af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe
"C:\Users\Admin\AppData\Local\Temp\af81f0168995870867c314cdd601213fb4b8d669e98b981e40f662e2ab9b0145.exe"
2⤵
PID:4608

memory/4284-134-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4284-135-0x00000000004A6000-0x00000000004AB000-memory.dmp

Filesize
20KB

Download
memory/4284-136-0x00000000004A6000-0x00000000004AB000-memory.dmp

Filesize
20KB

Download
memory/4284-140-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4608-137-0x0000000000000000-mapping.dmp

Download
memory/4608-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4608-141-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download