fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8

Analysis

max time kernel
329s
max time network
339s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:49

Target

fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe
Size

1.2MB
MD5

91f3d408c8b786802169f5b9d1571711
SHA1

38167e290b0a1e8ec8288061f37039e12451a689
SHA256

fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8
SHA512

c4038200cf1cf526f3f45e564fcf824166809681e5f8f1da4f41a39f0539b02a3b8d9ba593dad1596507f046fb698e6f5577ca17d1fac0bcef26aadc9075a100
SSDEEP

24576:58Ax9GLS59Q2SQUVqyeFtBJepApojDkfW/1RJMGdmXT:R955i2S5VFIBJewerJMkmD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84
PID 3988 wrote to memory of 912	3988	fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe	84

C:\Users\Admin\AppData\Local\Temp\fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe
"C:\Users\Admin\AppData\Local\Temp\fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\fad11248de55a901f3c64664078600a775d19e757a54ab4c1b266ee966139ef8.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:912

memory/912-134-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/912-133-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/912-135-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/912-136-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/912-137-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/912-138-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download