9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52

Analysis

max time kernel
112s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 16:07

Target

9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
Size

1.1MB
MD5

ee96e44918097e825c437d44f4f3b9a4
SHA1

d12c493ee29868f4fa94101624cc7d13a03de240
SHA256

9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52
SHA512

bb330b182a156668a6e624acdffe8745429fc08fc2e71459942c58502a650595736174e5645c73516ab6bb2dfeaf1d185eb4aa496bbf9e4c28e9765eacb5e5b2
SSDEEP

12288:oD3g1pennnnnCsBwGOHBvblq0ib9efT5AB+K10Ojb1uiABW+kH+bl4OEIAzInvT3:YBwFBzFAB+i/bk7kXHw+qBOaqjxKrGs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1344	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
1344	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
1344	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
1344	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
1344	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82
PID 4460 wrote to memory of 1344	4460	9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe	82

C:\Users\Admin\AppData\Local\Temp\9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
"C:\Users\Admin\AppData\Local\Temp\9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\9751defe3d760295e3591b3d975c673fa36407b3b931c2a17b5bd596b8d0ec52.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1344

memory/1344-133-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1344-134-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1344-135-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1344-136-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1344-137-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download