a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963

Analysis

max time kernel
149s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 01:18

Target

a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe
Size

1.2MB
MD5

290a72c932bf8dabef9430d84007698f
SHA1

06d5cf231d25a554a4b3a83a2005fbe0ffee2bc4
SHA256

a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963
SHA512

6e6c336002bf33df840876ec6def567b72fb65f593395534e9ad904823fc2f7cf9f7ad39384b46b82acde9441d3ced8c9d7813667c3323b6480d3c731260b53d
SSDEEP

24576:2pEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM0:UEqmvxD3pRaLcZIg+r

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79
PID 4752 wrote to memory of 2572	4752	a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe	79

C:\Users\Admin\AppData\Local\Temp\a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe
"C:\Users\Admin\AppData\Local\Temp\a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe
  "C:\Users\Admin\AppData\Local\Temp\a3951eeb0d38458341339e8a2e069c128dae5eeda6e320744aa4781811c04963.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2572

memory/2572-132-0x0000000000000000-mapping.dmp

Download
memory/2572-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2572-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2572-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2572-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2572-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2572-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download