3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:57

Target

3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
Size

272KB
MD5

5248883c9202850cc39be42cb5e473a0
SHA1

407860417bbe646ff8aa68e766f8120fd646a7a2
SHA256

3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f
SHA512

668c6d3acf7fb3b0a69431273f782dd690dcda610d4f7ec4bb836cfb6ef7772480fd1b5451b2435d683bd653e8c38eaed791633118580612af41d9ddbe7b3e10
SSDEEP

1536:HhzMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJmEx+DnJE/:Hh4X0e1FB/DpKjCLHMx+lEFqoo3I

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

description	pid	process	target process
PID 5040 set thread context of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

pid process

5040 3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

pid	process
5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

description	pid	process	target process
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
PID 5040 wrote to memory of 5080	5040	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe	3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe

C:\Users\Admin\AppData\Local\Temp\3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe
"C:\Users\Admin\AppData\Local\Temp\3a957e72f80e40abc7523a165bc24d12e816d49d971c97947ff902ed683c2e2f.exe"
2⤵
PID:5080

memory/5080-134-0x0000000000000000-mapping.dmp

Download
memory/5080-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5080-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/5080-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download