3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138

Analysis

max time kernel
187s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 00:35

Target

3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
Size

1.3MB
MD5

df384da35fb9ae86a4c9b6694c0a4150
SHA1

12df53564c3d4b457bcdcdeafff6336c8b445c7b
SHA256

3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138
SHA512

aa832aa7bfc3be7d89fd5e18612f777112f6201580f3b5de0c4ed7042aec237c61c69e6f7d9cb2d9601e6dc50ca63ac685ff1e9da0bb8541a2b9e85111bd96aa
SSDEEP

24576:lpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBPd:iyFPu8D9k5QELuLF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4576	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
4576	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
4576	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
4576	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
4576	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84
PID 3276 wrote to memory of 4576	3276	3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe	84

C:\Users\Admin\AppData\Local\Temp\3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
"C:\Users\Admin\AppData\Local\Temp\3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\3f419e1bf7029b07b6bff7dbfdd10a4e698aed4025e2d95c56a0220f38a15138.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4576

memory/4576-132-0x0000000000000000-mapping.dmp

Download
memory/4576-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4576-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4576-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4576-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4576-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download