b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49

Analysis

max time kernel
105s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:47

Target

b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
Size

92KB
MD5

c21c38a2f12e9abcab403ce7b3b8121d
SHA1

483a57b1ef186b36352d482804740d1df3726053
SHA256

b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49
SHA512

e85ba71603d6f50fe61688fcda732d128e9a445f9b153f48c3d733ea5921cff549eb2ab76ebda9227ffe93d0578374fb4acd736ced93c3b5eab7fb8350070bcb
SSDEEP

1536:EXZnsm2QX9DjWWdPBnQ/G6l/IU9KNWMwDz/xsz5FpTq:Hm245W//G6dONI2z5/q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

description	pid	process	target process
PID 1780 set thread context of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

pid process

1780 b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

pid	process
1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

description	pid	process	target process
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
PID 1780 wrote to memory of 1336	1780	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe	b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe

C:\Users\Admin\AppData\Local\Temp\b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe
"C:\Users\Admin\AppData\Local\Temp\b0fac756b71f2fa884679d55f43898d2ab0d7f6a4eacb78acc5dea65e610da49.exe"
2⤵
PID:1336

memory/1336-134-0x0000000000000000-mapping.dmp

Download
memory/1336-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download