b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758

Analysis

max time kernel
75s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 08:19

Target

b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
Size

1.0MB
MD5

ee416f4ac40beba056e6f0322e9f8de0
SHA1

f398b5319f0c58bf2b55829e96385735eb2e95ed
SHA256

b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758
SHA512

9016fdfe028ff3bcd0fd814609cda0ba24fd75635bbd4e199e8a65b4e6748efe4cace892261ca8f546892e774ea7793d65b4f4c7d0e3c58a0d39f17009f2c9f8
SSDEEP

24576:oJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpU:oWFPaXGalaCTt8XjwoGji87

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1432	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
1432	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
1432	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
1432	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
1432	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79
PID 3260 wrote to memory of 1432	3260	b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe	79

C:\Users\Admin\AppData\Local\Temp\b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
"C:\Users\Admin\AppData\Local\Temp\b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\b4b47b8c0481beafee376e62c94e6b270d89914271b4e1a11facf9fb0610f758.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1432

memory/1432-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1432-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1432-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1432-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1432-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download