3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3

Analysis

max time kernel
186s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:45

Target

3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
Size

1.2MB
MD5

af8babe423d48864ca28fd85a60ffb89
SHA1

e4beb96bdb2d4fd6b0ab553009d28cf0af1ac247
SHA256

3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3
SHA512

66d8d106dfb9b309edad358b613fcaf884772a1c0a5ba99ccb8d2c4420dd471ff368b9a9fea02a5e566b4d96adb519a627c2ac662af54b79e39c115d30c62df7
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4968	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
4968	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
4968	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
4968	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
4968	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80
PID 2132 wrote to memory of 4968	2132	3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe	80

C:\Users\Admin\AppData\Local\Temp\3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
"C:\Users\Admin\AppData\Local\Temp\3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe
  "C:\Users\Admin\AppData\Local\Temp\3f816558fc37f9f06363b693e152c749bec92fc1c356add22e7e17c1a5937cd3.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4968

memory/4968-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4968-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4968-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4968-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4968-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4968-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download