26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:47

Target

26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe
Size

1.5MB
MD5

5abd1f7f296f8bf3f28c461265d996ac
SHA1

8a72e134a08d445ed545ed8fdfdd55f1c364b90f
SHA256

26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73
SHA512

0fe547241da8cb8b92a0a37d97971f637ce1b57fba18ab7f88330ca511c39289bc7836d7103f01e29403caf1efc03bdbfa53aad5aa36b1fa5b142ba14d55e23e
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+v:YIBfvMkrNrf0u3qdaNLgQWiO+P

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78
PID 2564 wrote to memory of 4720	2564	26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe	78

C:\Users\Admin\AppData\Local\Temp\26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe
"C:\Users\Admin\AppData\Local\Temp\26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\26d12778132c338101a11564e51139f92159d22f404907b7e8235677e1e9eb73.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4720

memory/4720-133-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4720-134-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4720-135-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4720-136-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4720-137-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4720-138-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download