812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be

Analysis

max time kernel
175s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:28

Target

812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
Size

1.2MB
MD5

55a418a32f4e2865045fb8dd7f26f2a8
SHA1

cf2108ecd7cc7b4f1730b217d0b9c712c77b29e8
SHA256

812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be
SHA512

ec4d6f3374bc1ca9f37f797cb12a14c3b06acfc1db76a4d15d050608bfca5ead3fdabff6c21c5c60a22b6fe0c8b59a2c875301d3d496a1588131da3188692a5b
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80
PID 1996 wrote to memory of 3568	1996	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	80

C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
"C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
  "C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3568

memory/3568-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3568-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3568-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3568-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3568-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/3568-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download