988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2

Analysis

max time kernel
176s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:53

Target

988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe
Size

236KB
MD5

a0ccf77a8c5c03334cda7233cc06d91a
SHA1

d54ab50b7bcf70c020d8f9ce4bd8c5921d12b7ee
SHA256

988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2
SHA512

bfc62f03a0724d3dc8dd4027c9a8ac9aff46ee1dced8c54a95f641d25c62d8c9f52244e100f04306e6696c8dbda648398bf04218fa1082c6b748cf95d1aa8fe3
SSDEEP

6144:GuVmC7m5WHMYuXz9kXGk4rMwWKg57IAh0:D4Yu2ard2O

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe

description	pid	process	target process
PID 3404 set thread context of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe

pid process

3404 988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe

pid	process
3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe

description	pid	process	target process
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
PID 3404 wrote to memory of 1168	3404	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.exe	988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE

C:\Users\Admin\AppData\Local\Temp\988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE
"C:\Users\Admin\AppData\Local\Temp\988dca6269410339e1c1eb329a2b610029bfc5a3b80e7aeb0a9c9fc7f2509db2.EXE"
2⤵
PID:1168

memory/1168-134-0x0000000000000000-mapping.dmp

Download
memory/1168-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1168-137-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1168-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download