9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056

Analysis

max time kernel
203s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 02:03

Target

9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
Size

1.4MB
MD5

9846abc6c72342ed5df74340d951baa8
SHA1

06404b074a67e3b636ff8f3f3eff1435ca5f551a
SHA256

9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056
SHA512

41bc245f35ad7424f05ca49e5037db652c784cc129fed93f12391ac8750ac41288759392a97ec3fc393bd8f6bd5242e9da25facb16e8ae9c23dfa2121c76b717
SSDEEP

24576:xrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AW:xrBew72604doSw6ew5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5060	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
5060	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
5060	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
5060	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
5060	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82
PID 1904 wrote to memory of 5060	1904	9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe	82

C:\Users\Admin\AppData\Local\Temp\9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
"C:\Users\Admin\AppData\Local\Temp\9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\9cb3084b2caaa58a7d228cab5f18c04256c9e5c1c95791dafcc9c5a90a4f2056.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5060

memory/5060-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5060-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5060-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5060-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5060-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/5060-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download