c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:52

Target

c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
Size

1.4MB
MD5

8971875eb27404eac70d7401ba672266
SHA1

b270f062ba2b20647f0fe9ba49e81dd5b974763b
SHA256

c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6
SHA512

9e9e864fd90bf6624c03e1f804717e6e63b438d4480c28a7aace689fc7bfe1e773a55a18455e52b8366fb99050f00082539ac88076e831198bccd2e1c20aeba3
SSDEEP

24576:RrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AD:RrBew72604doSw6eww

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3584	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
3584	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
3584	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
3584	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
3584	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82
PID 4988 wrote to memory of 3584	4988	c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe	82

C:\Users\Admin\AppData\Local\Temp\c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
"C:\Users\Admin\AppData\Local\Temp\c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\c02ac7ca92d055f95b0dcae8282410fa230a3c528f8509593c0129da9cf36bb6.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3584

memory/3584-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3584-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3584-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3584-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3584-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download