f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:07

Target

f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
Size

1.2MB
MD5

b363702d3fd8c0be1f7375a4a9f11304
SHA1

958ccc096650823c373d3ec800d8008e085d4478
SHA256

f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16
SHA512

60bfb4a66be2f4ef01bdec51325badab8e0eae680ce6da3e75d15b0d99b9c3f84a327c7b47fa89b7d7ac82e3eadb5e18abdce77d0f5004d714d678241dfd6065
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68m5:6MdkS6IsXkRX0bQEgYe709hD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3444	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
3444	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
3444	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
3444	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
3444	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80
PID 2376 wrote to memory of 3444	2376	f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe	80

C:\Users\Admin\AppData\Local\Temp\f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
"C:\Users\Admin\AppData\Local\Temp\f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\f29b0a2e973352d1b79ae56304b32fa63f0cf7a4e6362f7ea9eb19161c2b9d16.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3444

memory/3444-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3444-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3444-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3444-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3444-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download