72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f

Analysis

max time kernel
150s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 01:32

Target

72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe
Size

1.2MB
MD5

837b05d2f8bbe71415abf908a2db6025
SHA1

573e82238488473334f41eda179271b8fc077fad
SHA256

72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f
SHA512

ed2a7e49fe80bc0a8dada56bf9e461100bbc01cf657959dcf00ee99fe2862664bfd84eaefafa13bd446e2646312029f897b15604b9a308b0f772fe3b597ecc48
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1892 set thread context of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86
PID 1892 wrote to memory of 2864	1892	72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe	86

C:\Users\Admin\AppData\Local\Temp\72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe
"C:\Users\Admin\AppData\Local\Temp\72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe
  "C:\Users\Admin\AppData\Local\Temp\72669bfa5eeb63a87a900d695369546df64f60e0ccd01d4542cd34074886209f.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2864

memory/2864-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2864-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2864-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2864-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2864-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2864-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download