cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df

Analysis

max time kernel
198s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:47

Target

cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
Size

1.4MB
MD5

2fe194c58a08238962991ddc6b356427
SHA1

0c973c9c334aa16ce51aff2b214387885ad4d172
SHA256

cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df
SHA512

2991f38b48ad87b15869b575f7c1dfcb1d59a5163bcca4f1adc5c30339147aed142c716f6185ac358565afd2fe4b026bf7f99da0c8a21858fc454f6ef4f8b125
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ac:hrBew72604doSw6ewv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
708	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
708	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
708	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
708	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
708	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85
PID 4336 wrote to memory of 708	4336	cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe	85

C:\Users\Admin\AppData\Local\Temp\cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
"C:\Users\Admin\AppData\Local\Temp\cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\cbe7efada48386915deaa4d616ecf92813898f516100b8d3df78f9597935f3df.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:708

memory/708-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/708-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/708-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/708-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/708-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/708-139-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download