365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:13

Target

365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
Size

1.3MB
MD5

0e938c229b627068cc59d022aa939303
SHA1

c222eaf96eeda63f0bb49be9cb00250e058aa93a
SHA256

365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c
SHA512

8afdb4b5dae6150ce686861c87eb65a8bfc9ea90df5bdbe07bc5f6178f66c78583ee1be146a0bbb4b0e03cf25968bd50fa9a86922c447a195109625b03880bac
SSDEEP

24576:+uq2tmafPHRCOfLIRT26ULQX+llih7yzs905h0OsYOl9ooM3hGrBswDNg7:kaHPixOa9puD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4848 set thread context of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4880	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
4880	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
4880	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
4880	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
4880	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81
PID 4848 wrote to memory of 4880	4848	365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe	81

C:\Users\Admin\AppData\Local\Temp\365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
"C:\Users\Admin\AppData\Local\Temp\365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe
  "C:\Users\Admin\AppData\Local\Temp\365431b891cb08ea837cc4c46f64e0201969c4a7dd7572dea0af711a8ffa7a6c.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4880

memory/4880-132-0x0000000000000000-mapping.dmp

Download
memory/4880-133-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4880-134-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4880-135-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4880-136-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4880-137-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4880-138-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download