f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00

Analysis

max time kernel
150s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 13:24

Target

f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
Size

1.3MB
MD5

14e16d804b11c76175b7e6284d3a0c51
SHA1

135fd924e33756cbddaa73b44e8c00a8ce5677f5
SHA256

f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00
SHA512

cac70dbad1b84619eddd1b779495f8deb8a93316aecb827b39ec44a4b002b13aaa1574081934afb7208964934b7351d5b64bb67b1a718b53d5f74d44d830cf47
SSDEEP

24576:4OiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe99:Ri1DWLFP53UGe76x0ZUphdtu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1180	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
1180	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
1180	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
1180	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
1180	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85
PID 2964 wrote to memory of 1180	2964	f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe	85

C:\Users\Admin\AppData\Local\Temp\f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
"C:\Users\Admin\AppData\Local\Temp\f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\f4c391e380764ab021dbfc65c1f38974f8191ff5e1a80fe31757576b3acd7f00.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1180

memory/1180-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1180-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1180-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1180-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1180-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download