b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba

Analysis

max time kernel
189s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:11

Target

b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
Size

1.2MB
MD5

46260e6eda5281a89f47e51c74478866
SHA1

22be950825470c7ce6388178d22515ab73ff75bf
SHA256

b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba
SHA512

ed47f6cb69d41c6ef7abcd1a40722ea85029c05929f1dad1f50d99868f9dc4afff8175a3d4974ae9b0d0ec99665055a24e3088479c147a8d0f17c3ba1008fea4
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM8:EEqmvxD3pRaLcZIg+r

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 380 set thread context of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2172	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
2172	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
2172	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
2172	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
2172	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83
PID 380 wrote to memory of 2172	380	b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe	83

C:\Users\Admin\AppData\Local\Temp\b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
"C:\Users\Admin\AppData\Local\Temp\b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe
  "C:\Users\Admin\AppData\Local\Temp\b8f5085fcf2c823bd091efa07502fcae4f16c20598e9cf7602e6031c887742ba.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2172

memory/2172-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2172-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2172-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2172-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2172-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download