079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f

Analysis

max time kernel
190s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:01

Target

079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe
Size

1.2MB
MD5

abe62327adaab933d6ced6a646b7ca59
SHA1

85ad7956e4f59c1053f2b0c0b3ff207467c2ca30
SHA256

079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f
SHA512

e280c1cf393abe39b260e6070050ecc1a8e34cbe34818c452029924269e1a7c601ea134ce2d7ef2127ecbb81fb409a3139ad5d7de55674867178f420033a2239
SSDEEP

24576:GpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMa:kEqmvxD3pRaLcZIg+p

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81
PID 2480 wrote to memory of 1540	2480	079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe	81

C:\Users\Admin\AppData\Local\Temp\079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe
"C:\Users\Admin\AppData\Local\Temp\079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe
  "C:\Users\Admin\AppData\Local\Temp\079232816e39f7b5b5450f3410b63159308bbf9eca560fbd9547d766e215211f.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1540

memory/1540-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1540-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1540-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1540-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1540-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download