f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0

Analysis

max time kernel
136s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 08:41

Target

f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe
Size

1.3MB
MD5

2f54fe953bd347de0d7d1fc2c79d7913
SHA1

04fd243d0d6f3ced6f969a63dfc45e9ecba02143
SHA256

f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0
SHA512

151c08e10250dd71f7379e519de8ff69b1e2e1a94d7c4b0f7fd720f45430124e88b096f9cbc39bff437ee76a9556b1301f9e77d6332e16012b0f9dc38030b463
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:zrKo4ZwCOnYjVmJPaC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81
PID 2144 wrote to memory of 3452	2144	f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe	81

C:\Users\Admin\AppData\Local\Temp\f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe
"C:\Users\Admin\AppData\Local\Temp\f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\f762b32e5612e2897ab6f79f43e5ad2360d165266c5be14627fd471ed77b04a0.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3452

memory/3452-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3452-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3452-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3452-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3452-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3452-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download