fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6

Analysis

max time kernel
176s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 08:22

Target

fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
Size

1.4MB
MD5

e8c7a08b45f8b7ce1caa5a03b5552e56
SHA1

b8d0e366cebb1e41e46a2d9a7a49c0a64a1e1048
SHA256

fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6
SHA512

f31fadf3c031bd2dfc3c734c63daefcf2f4cf406820bed60a8c39f91385250e8fa7db55fcd74f8447509d79d546aa8bee7469c4697ffbf60079bb62f877db759
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aq:BrBew72604doSw6ewR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3660 set thread context of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
216	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
216	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
216	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
216	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
216	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83
PID 3660 wrote to memory of 216	3660	fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe	83

C:\Users\Admin\AppData\Local\Temp\fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
"C:\Users\Admin\AppData\Local\Temp\fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\fa19462e5eab45daee706458b703988a07a25f5fe2e994c22fe266c78df1c0d6.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:216

memory/216-133-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-134-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-135-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/216-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download