a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02

Analysis

max time kernel
143s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 14:05

Target

a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
Size

1.3MB
MD5

1095e0ef8c2f04bbe568c7e1d8fde7cb
SHA1

78308d140f491d59ee63247a28710fc32552a3be
SHA256

a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02
SHA512

863ac9013dc9863fd161e8f0348b77550fb8ca4aabe531c487675090f5dbb7b6b1a033d4a223b24bc0c3a16340b2a7c451a9172a6d1a46888413fdc4704eb4f3
SSDEEP

24576:4OiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9O:Ri1DWLFP53UGe76x0ZUphdth

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
544	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
544	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
544	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
544	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
544	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81
PID 1000 wrote to memory of 544	1000	a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe	81

C:\Users\Admin\AppData\Local\Temp\a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
"C:\Users\Admin\AppData\Local\Temp\a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\a39bc3322b9c63fdab78fec16965c80733fee9b0b2677e40f9edfece603e1a02.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:544

memory/544-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/544-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/544-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/544-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/544-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/544-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download