169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538

Analysis

max time kernel
94s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 16:03

Target

169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
Size

1.0MB
MD5

a5c18607f89383ae9a9ea868abc91f85
SHA1

cb2e9a46d85487c65e31a5e0de4f76ab6d0387a2
SHA256

169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538
SHA512

7ae365160258688b2d7786198006dcf8ad914d1c5ae50465369922b850b212fbfba904866d9fc658e7e039fab91bd2abd9021de21d8eb5d628de62eeaee146da
SSDEEP

24576:/FPX97BbdQstJ2C/iN7F+ClRV95ZAuvjZtD37:/FPtVdRtJ7qT7lRv5ZAuvNl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4208	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
4208	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
4208	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
4208	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
4208	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79
PID 5056 wrote to memory of 4208	5056	169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe	79

C:\Users\Admin\AppData\Local\Temp\169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
"C:\Users\Admin\AppData\Local\Temp\169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\169cc695b37d1569fcab5ddbd15c5064f21c651948d6efcd13a7fc62b5c73538.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4208

memory/4208-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4208-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4208-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4208-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4208-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download