ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95

Analysis

max time kernel
158s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:48

Target
ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
Size 1.4MB
Sample221124-b74qtsad36
SHA256 ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95
MD5 80df6a1f132b04ba45c4fdeabfdce5d6
SHA1 1028492a980fae476f7f220e341b7dfdd72ea7e4
SHA512 e0a6d3f43370778a18b69d3d08130dccb54ee72d67d3a9ac69706ef446b0d26aea98bf5c923cf6a0b6b10619cc9f2ab66faadbf3ae162b21a078088fe5bfdc47
SSDEEP 24576:RrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AC:RrBew72604doSw6ewd
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1564 set thread context of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4896	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
4896	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
4896	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
4896	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
4896	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80
PID 1564 wrote to memory of 4896	1564	ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe	80

C:\Users\Admin\AppData\Local\Temp\ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
"C:\Users\Admin\AppData\Local\Temp\ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\ca675e7315aef8c539f8c39f4e3a595a8fa6cc6a4f424dfe9c57f76d24353f95.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4896

memory/4896-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4896-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4896-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4896-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4896-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4896-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Download