b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:27

Target

b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
Size

1.3MB
MD5

a56c296bd84eeab081f34944d3e10a26
SHA1

d23c5a87647ef03f04e458a6a18cf875d21158aa
SHA256

b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6
SHA512

2a9eba5acb6afae30d847db48307e89ac0a7af9d6fb650ff408666aa4e7c7d3d88d0beec7a499a76c9f3b13d436fa49c9088acec34b42897d310061a2ac43c32
SSDEEP

24576:WKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcuK:WKVzMNuwIKyoBmnMSURNQq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5032	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
5032	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
5032	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
5032	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
5032	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82
PID 1944 wrote to memory of 5032	1944	b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe	82

C:\Users\Admin\AppData\Local\Temp\b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
"C:\Users\Admin\AppData\Local\Temp\b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\b62807d0dc86b4f7c9714c43fbd62ac98ba210890e0d194344d9b07093b15ea6.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5032

memory/5032-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5032-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5032-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5032-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5032-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5032-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download