a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a

General

Target

a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
Size

1.9MB
MD5

56868e22bdfacb562743c819b13757ed
SHA1

0c4a07d04b9c671ca18ea187ee1053adf2a4df85
SHA256

a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a
SHA512

f9c6823a828c9bc536d2c72aed402cc1d16ca7854f14e5b77a7b1a6dace9ed6a4f45ba85d74d1a849da195ce5796997cfa38dcc6effcfece25337c3f41e8ec3b
SSDEEP

49152:LVg5tQ7aQis5P7kuXMkV07sgjlSAPIiUr9G:Bg561PMkV6wAPIiU4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1268	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
1268	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28
PID 1436 wrote to memory of 1268	1436	a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe	28

C:\Users\Admin\AppData\Local\Temp\a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
"C:\Users\Admin\AppData\Local\Temp\a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe
  "C:\Users\Admin\AppData\Local\Temp\a5aa175632338857ae12b9718eac9560f48cdcdceb114f7c7c05a774a15bdd8a.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1268

memory/1268-55-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1268-57-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1268-59-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1268-60-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1268-62-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1268-63-0x0000000000080000-0x0000000000179000-memory.dmp

Filesize
996KB

Download
memory/1436-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download