ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18

Analysis

max time kernel
310s
max time network
333s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:54

Target

ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
Size

1.4MB
MD5

6558f70cdb09b5c3ed37b369b24cbe69
SHA1

a28448e1751360d7e940b349004ea53ad439f7c4
SHA256

ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18
SHA512

caaef9f9ad4355595ccaffe9d07cf4651cb8900d2d69ff752179f29f294e71b5ecb56225d317622c9700dc0bd28faba7aec813d33d73da192914ba3b8d2cd5d2
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ar:hrBew72604doSw6ew8

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1592	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
1592	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
1592	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
1592	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
1592	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81
PID 3456 wrote to memory of 1592	3456	ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe	81

C:\Users\Admin\AppData\Local\Temp\ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
"C:\Users\Admin\AppData\Local\Temp\ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\ba65d2b47d696a6b048061cd70e1e14fc8d329500fc2c7900fb72183be222c18.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1592

memory/1592-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1592-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1592-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1592-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1592-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1592-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download