951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce

Analysis

max time kernel
201s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:22

Target

951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
Size

1.2MB
MD5

dc3e9ab5902b4012aa2d7c8487481c39
SHA1

64d1d9545fc87f51a09c4a4f74610aae8f3d69a8
SHA256

951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce
SHA512

9e3cd677bad33db586d5f10499c16ffd3991407c74d6932c7b9c2d3f04a44ed5769c386bb29b6566138770243f8b9da49bd7876c180e5014f8577b298a74b7c7
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2876	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
2876	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
2876	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
2876	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
2876	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81
PID 1824 wrote to memory of 2876	1824	951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe	81

C:\Users\Admin\AppData\Local\Temp\951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
"C:\Users\Admin\AppData\Local\Temp\951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe
  "C:\Users\Admin\AppData\Local\Temp\951f089e2a1dfc4a55540e7a9e0ac013ac5c6ec5954e33558f8e513d150c92ce.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2876

memory/2876-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2876-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2876-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2876-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2876-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2876-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download