9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a

Analysis

max time kernel
268s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:31

Target

9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
Size

1.3MB
MD5

0bcc852454ca0a7e38bfa57f8bab9c82
SHA1

1294fe23828432d7b854efdab4df98cc993a2413
SHA256

9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a
SHA512

4608e340a477cc06c59f9ae61b967dd1bac28bc5a205569d9484d5be5553027c2080d0b5d2cff779b654a6070faa65826109bea64244a258cc49079f778ca538
SSDEEP

24576:EpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBPt:LyFPu8D9k5QELuLV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3440	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
3440	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
3440	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
3440	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
3440	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81
PID 2912 wrote to memory of 3440	2912	9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe	81

C:\Users\Admin\AppData\Local\Temp\9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
"C:\Users\Admin\AppData\Local\Temp\9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\9ba12ab92e47fc90b5bde85a99194e51388bc4741b621fb1c1b130c2bc92ab1a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3440

memory/3440-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3440-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3440-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3440-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3440-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3440-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download