b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:05

Target

b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
Size

1.2MB
MD5

1226108928ec33337c7ed229fb6d57bf
SHA1

3c0c40a2e7132579e43d682d87f9b82b556c3607
SHA256

b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a
SHA512

81a38e8da2a68c739f853a7b8786f360b8c4c0022020aa50efbf034392efb50e86919f2687dfddfd2bbf67f0fadaddfcd17307529d193a14ce0e3f31ebcaa177
SSDEEP

24576:pXIe1k135jsYx0ySMIAA/9I+8jhIFqpmMcZIKxKfI:pXfyFBIAupqpm1asx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1568	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
1568	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
1568	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
1568	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
1568	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80
PID 3464 wrote to memory of 1568	3464	b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe	80

C:\Users\Admin\AppData\Local\Temp\b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
"C:\Users\Admin\AppData\Local\Temp\b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\b50654d0a9bac75be3dc80dfe48d04f10cbec6b7670f400504a43d2239ffc17a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1568

memory/1568-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1568-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1568-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1568-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1568-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1568-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download