2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:51

Target

2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
Size

1.2MB
MD5

aa899559a612888612d2644af7407f66
SHA1

ce4131886993207fad622fde7468a56810742841
SHA256

2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f
SHA512

b3aaed0e503714a1ffa99aa9527bb0dd942410e56d1cf97a6edee2aa1151455d043f8cd11a5c914d5a075d38c93339617d54930ae43628bd9ce9d246a623f10f
SSDEEP

24576:WpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM5:0EqmvxD3pRaLcZIg+u

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3228 set thread context of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2972	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
2972	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
2972	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
2972	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
2972	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80
PID 3228 wrote to memory of 2972	3228	2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe	80

C:\Users\Admin\AppData\Local\Temp\2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
"C:\Users\Admin\AppData\Local\Temp\2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe
  "C:\Users\Admin\AppData\Local\Temp\2bd02d18e7819b2dba86019163bd319cd17db07fbfc62772475d86c06f8c904f.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2972

memory/2972-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2972-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2972-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2972-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2972-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2972-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download