4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:40

Target

4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe
Size

1.2MB
MD5

b362dc3c372479b63239528d68550a33
SHA1

2549062ad7b62303e67f1d2d485f5521d18ef4ac
SHA256

4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5
SHA512

2b28aafde746b33a322c96b5ea8278a28d785e2abf2cf82d61fd78427ce7cc9fb596d42a031d296af164238c9f177e95783b47634bdba80d6ce09db287bf3895
SSDEEP

24576:5bkiGUv38BEDWRR2cU1kPLtOF5Tr287ZTPcyAKYP+y42C4:uqvCEaRkca2Yb/3PmKxqB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4876 set thread context of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82
PID 4876 wrote to memory of 1016	4876	4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe	82

C:\Users\Admin\AppData\Local\Temp\4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe
"C:\Users\Admin\AppData\Local\Temp\4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\4f279930022019888559fd9f0d292225f58b69cfebf7d2e7d85b280d472ec8b5.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1016

memory/1016-133-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1016-134-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1016-135-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1016-136-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/1016-137-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download