a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd

Analysis

max time kernel
174s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:56

Target

a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe
Size

78KB
MD5

34f015193e52cbdd64b2e571ac8a6821
SHA1

2da47a76cf34246907cf18f5334351540e7f31a1
SHA256

a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd
SHA512

ac1192dea1ad578819e19aea4558ae0c1ff934714e49bf16b9571ad2b71e6ff130876ba055c502dbb3c0214303e83219cd934f0a52f3462402fd3390f331fbb4
SSDEEP

1536:bKd2BCX4Xs95BXS6x4ZSUzkQM+FwIwEORuZiLl9PXbYpcb:bKdUCD5oOcS3r+FwIwpk6lSO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83
PID 4260 wrote to memory of 3096	4260	a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe	83

C:\Users\Admin\AppData\Local\Temp\a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe
"C:\Users\Admin\AppData\Local\Temp\a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.EXE
  "C:\Users\Admin\AppData\Local\Temp\a378cc0a0a8e1f45b8656365b156464dd730ac5de41854a25915dd02c08c7ddd.EXE"
  2⤵
  PID:3096

memory/3096-136-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3096-135-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/3096-134-0x0000000000000000-mapping.dmp

Download