2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75

Analysis

max time kernel
178s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:51

Target

2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe
Size

1.2MB
MD5

15e7d9bcc0a76d57bebc18659eda5854
SHA1

1038cbc35a3d4064fc434e0f54e33373a248c035
SHA256

2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75
SHA512

e0da726173839f58a1c399c567221e603caebee51f49dc5772c12625b245792be04f730dc84f2120056804f446d8145db0e630a1d4226d9eb6d0d4e5151a7c44
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3868 set thread context of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81
PID 3868 wrote to memory of 3660	3868	2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe	81

C:\Users\Admin\AppData\Local\Temp\2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe
"C:\Users\Admin\AppData\Local\Temp\2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe
  "C:\Users\Admin\AppData\Local\Temp\2b7f3f1db09a5b6393152f670a78f72a667644542791f8582d435d9af399ed75.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3660

memory/3660-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3660-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3660-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3660-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3660-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3660-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download