a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7

Analysis

max time kernel
274s
max time network
321s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:05

Target

a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
Size

1.2MB
MD5

b28c8c3786f966473530a7309a8e0d21
SHA1

71c4ee0c32a72e86fe280084ee3a8b4eab0dc5a0
SHA256

a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7
SHA512

8a0d4650d8eb44a7837284ae4163c348c051ad75e197c74c8cc761244857703d1d539cca82113b10a762bab831a1a9f3cb3a2b32daee70b09a0e7046941ab9e4
SSDEEP

24576:tXIe1k135jsYx0ySMIAA/9I+8jhIFqpmMcZIKxKf4m:tXfyFBIAupqpm1asrm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2196	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
2196	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
2196	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
2196	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
2196	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80
PID 3016 wrote to memory of 2196	3016	a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe	80

C:\Users\Admin\AppData\Local\Temp\a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
"C:\Users\Admin\AppData\Local\Temp\a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\a2fa6adeb12706e21d830cf0b0403b5ba061b4a64eece49b5c24bc7ef2e294f7.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2196

memory/2196-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2196-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2196-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2196-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2196-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download