37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a

Analysis

max time kernel
145s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:47

Target

37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe
Size

1.5MB
MD5

d46ac403643a96a2e0a848f4fa82aebc
SHA1

31fd2cff81485e08d529b49b14e887ffbd66b4fb
SHA256

37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a
SHA512

fc9638ca88fd1b791d06de2e0e061503c96dbbd7fd345e26e1d3998db5233aa02ad16ae8675d0d93c866390a4bdf2d0f3e4bca0b8e55c532cf79fd0f1c74faa0
SSDEEP

24576:C5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+d:oIBfvMkrNrf0u3qdaNLgQWiO+9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79
PID 4648 wrote to memory of 3976	4648	37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe	79

C:\Users\Admin\AppData\Local\Temp\37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe
"C:\Users\Admin\AppData\Local\Temp\37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\37635b3d82f3c3de5d82e17e3bf243a72b5204830fdc002365367470d448671a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3976

memory/3976-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3976-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3976-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3976-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3976-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download