7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22

Analysis

max time kernel
153s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:01

Target

7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
Size

1.2MB
MD5

7495429ce590501c735fdc0fe1f7d342
SHA1

87176cbf0438fe78a22e4cdb3bf877ed53731ab6
SHA256

7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22
SHA512

69c5a2f2c5eebf3bf74c9bb134dfc54ce260ba65859232bb71604eaef9be5ba7ee1b4c56becc2dab9e4060622a2af7f7d1993849ece739a0914241d3ff377a72
SSDEEP

24576:aMdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mI:aMdkS6IsXkRX0bQEgYe709hy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4900 set thread context of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4020	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
4020	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
4020	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
4020	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
4020	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81
PID 4900 wrote to memory of 4020	4900	7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe	81

C:\Users\Admin\AppData\Local\Temp\7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
"C:\Users\Admin\AppData\Local\Temp\7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\7afd8ae1d3d168bdc7e3ca438b7e6538cc83d07c188d9dbef4b1d8a530294e22.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4020

memory/4020-132-0x0000000000000000-mapping.dmp

Download
memory/4020-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4020-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download