b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:59

Target

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
Size

64KB
MD5

25b5c130b65a18dfd24fb5e115673309
SHA1

ebd466c5bfbfe172f4c7e002c349f9f51f0949e2
SHA256

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3
SHA512

c3040c1fc75e27834c36f439667269bf2679e5fdd2cb1ed1735c8f1c0093469f7d210d75be3e2ce8dad48461100f7faea857328e10694dbecfb94686d0b4069a
SSDEEP

1536:E07iT13vfdHldhwTkdZKNu3dJO7tZ9Cb8lHpwo9gLd:1i53vfdHldhwTIKNsTO70YlHBgLd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

description	pid	process	target process
PID 2472 set thread context of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

pid	process
2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

description	pid	process	target process
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
PID 2472 wrote to memory of 2548	2472	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe	b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe

C:\Users\Admin\AppData\Local\Temp\b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
C:\Users\Admin\AppData\Local\Temp\b9a54ef4f769068af029aa7941c464990c476911180c9f4ec3379ab3b51ff5b3.exe
2⤵
PID:2548

memory/2472-132-0x0000000002240000-0x0000000002244000-memory.dmp

Filesize
16KB

Download
memory/2548-133-0x0000000000000000-mapping.dmp

Download
memory/2548-134-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2548-136-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download