f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba

Analysis

max time kernel
182s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:49

Target

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
Size

80KB
MD5

83b5c4c91e61728fa83fcf93451cfe23
SHA1

e667504dfe1a454d7d994134bcb947d48006c71f
SHA256

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba
SHA512

be70d445b24be2552f0be7001d6aa570cb8179a8408fa231988a30c600ec5e425406eb937e8bea6b27cca0566f1934a1e0fcad589bfc821a30891ec52c981347
SSDEEP

1536:ua02w4XHHHDEC70WrP1lhmDdimz/RMhkv6U:u4DHHeWrPThGP2kvB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

description	pid	process	target process
PID 2808 set thread context of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

pid	process
2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

description	pid	process	target process
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
PID 2808 wrote to memory of 3220	2808	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe	f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe

C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
C:\Users\Admin\AppData\Local\Temp\f4ae9b19f5d5dd4cc596d2577edebcd6d97c5048e631eb67ddc20aa45ac2f8ba.exe
2⤵
PID:3220

memory/2808-134-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download
memory/3220-132-0x0000000000000000-mapping.dmp

Download
memory/3220-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3220-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download