cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4

Analysis

max time kernel
174s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 16:14

Target

cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
Size

1.3MB
MD5

a6d401d1c39e1f92ca9fe9ccc79791e7
SHA1

e6e1e3793d96060df8d2cbdaa1423209a9d20fe8
SHA256

cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4
SHA512

333d1d3bd7cbf375ce059b153f1b2d215dc13f7d88cb6376219fbb5461af72405a3934fb4cdf5d7f3a10a8c116fa50bf5562c7af5174b02d858f0099dda31d6b
SSDEEP

24576:WKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcur:WKVzMNuwIKyoBmnMSURNQL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3188 set thread context of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1576	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
1576	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
1576	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
1576	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
1576	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78
PID 3188 wrote to memory of 1576	3188	cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe	78

C:\Users\Admin\AppData\Local\Temp\cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
"C:\Users\Admin\AppData\Local\Temp\cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\cfafc7eb6c0c6c5b8a736d5e1382d12c81ecd8ae1e996f8f2e9e555ee8639ed4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1576

memory/1576-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1576-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1576-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1576-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1576-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download