a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:18

Target

a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
Size

1.2MB
MD5

cac13616e8461fd9feb327a213a8737d
SHA1

0b66e5fbf3c8c7bd86deb7e8142568429c2e0168
SHA256

a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980
SHA512

b7de7557493b7a6425c6a956ab7ac27f920f65ae60407c047fb376a39eb642ae68080e91a721113c2aff6e260a8fe7587ec352d367c3954843b3e6893da86455
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMU:EEqmvxD3pRaLcZIg+r

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
840	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
840	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
840	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
840	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
840	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81
PID 5080 wrote to memory of 840	5080	a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe	81

C:\Users\Admin\AppData\Local\Temp\a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
"C:\Users\Admin\AppData\Local\Temp\a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe
  "C:\Users\Admin\AppData\Local\Temp\a4322df1ef8bce07f36c77c2a8eacba72861bd87a6d6158af6851f156dccf980.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:840

memory/840-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/840-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/840-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/840-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/840-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download