ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2

Analysis

max time kernel
188s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:57

Target

ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
Size

1.3MB
MD5

353fd631d680e876b57f29b64bcd20a6
SHA1

82d44e1868f3e260421919160d0f3665f80f3758
SHA256

ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2
SHA512

b605d17d315e1f94d5fa0a3efb4d7b4b3ead5128a34cd158cccb862f0386567020c164f6c2d600e8e84825dd3b68c9ea9dae65ff7afba0951dd0d2ce719f8ab8
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:rrKo4ZwCOnYjVmJPah

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
344	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
344	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
344	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
344	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
344	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82
PID 220 wrote to memory of 344	220	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	82

C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
"C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:344

memory/344-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/344-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download