756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d

Analysis

max time kernel
185s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 05:22

Target

756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
Size

288KB
MD5

f53b47a30d06f7dad7b0c8bca5090561
SHA1

316cc7d23a93c64fad286dcad46bb6cc8bf6b497
SHA256

756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d
SHA512

4e06c32afda87a94fcdf9f44ad0dea7dcbb8df1cad11b6d5290ec97f1ae48d602abe7f7f112abb38a07164eca400536126a85bde4c287b85647dcb3e529711ac
SSDEEP

3072:5IwuPE5GCEGeDQ6zeNzagdBvlyRUYRjUQKhsh/wzDmmRbWCcI4NHcaCVEOuPB:5qukGeDPUdByR5lqsh43VRbUD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

description	pid	process	target process
PID 5084 set thread context of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

pid process

5084 756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

pid	process
5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

description	pid	process	target process
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
PID 5084 wrote to memory of 3412	5084	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe	756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe

C:\Users\Admin\AppData\Local\Temp\756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe
"C:\Users\Admin\AppData\Local\Temp\756444a61fc55e3e35b9f52fa4fba1bc8e7e77451745b643a0a12eb35b72fb4d.exe"
2⤵
PID:3412

memory/3412-135-0x0000000000000000-mapping.dmp

Download
memory/3412-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3412-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5084-134-0x0000000000813000-0x0000000000815000-memory.dmp

Filesize
8KB

Download