2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8

Analysis

max time kernel
253s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:19

Target

2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
Size

1.1MB
MD5

734a4e0ae9beebb3b14b0c29955a84dc
SHA1

09e94e2fb81e0b9c109310bf9010a586cbc53ae9
SHA256

2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8
SHA512

921dead3802d51bb4a0e3da6b8073d0e135cf42aeb874cd1797a94f6ec80f1ba9702a6e9c39cbea8aa714a594bfc215a34242341d2ce2fe3ae44480c4aad558b
SSDEEP

12288:oD3g1pennnnnCsBwGOHBvblq0ib9efT5AB+K10Ojb1uiABW+kH+bl4OEIAzInvTp:YBwFBzFAB+i/bk7kXHw+qBOaqjxKrGW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 204 set thread context of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2676	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
2676	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
2676	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
2676	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
2676	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85
PID 204 wrote to memory of 2676	204	2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe	85

C:\Users\Admin\AppData\Local\Temp\2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
"C:\Users\Admin\AppData\Local\Temp\2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\2b2ce49dfece97934f66b816c2652104f43e2337faf7307e036e5a921ef90ca8.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2676

memory/2676-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2676-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2676-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2676-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2676-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download