0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4

Analysis

max time kernel
122s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:43

Target

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
Size

371KB
MD5

e2440f0ae4154108fc6daded2b2ba4cf
SHA1

60f4f6d733c05861ef1be17e7dc7f13f7b3c2ca5
SHA256

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4
SHA512

765350cf754cab83b1a454c0ce5b8cacd9bad36b8fd70714745c9ec47cc26d3dbd8cb61f8fa9cbf9c4a6c5da26af9f412a1b0f2da42d9d77be47274dc5210322
SSDEEP

3072:v1tn5ymi8Eu11uZaLJbN2SQ3N7Do0JgT5SVtoaKGlD8yWC242UcdRCU4J4lg4E4I:Zeqb1rrcdpsyD80BPYl8QEihC5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

description	pid	process	target process
PID 2356 set thread context of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

pid	process
1812	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
1812	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
1812	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
1812	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

pid process

2356 0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

pid	process
2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

description	pid	process	target process
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
PID 2356 wrote to memory of 1812	2356	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe	0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe

C:\Users\Admin\AppData\Local\Temp\0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
C:\Users\Admin\AppData\Local\Temp\0aea6482bba30e5d1793c133fa2a6e340b664fa05ee8c7e27e9881804057a7c4.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812

memory/1040-139-0x00000000FFFF0000-0x00000000FFFF7000-memory.dmp

Filesize
28KB

Download
memory/1812-135-0x0000000000000000-mapping.dmp

Download
memory/1812-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1812-138-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1812-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2356-132-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download