156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb

Analysis

max time kernel
159s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:14

Target

156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe
Size

1.2MB
MD5

776a9b469a55c381da70e9eac5251179
SHA1

3afb9e3b9ee09cd834049dd58583d7dc242dbbd4
SHA256

156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb
SHA512

ca71b8b98065523006ede1d2a2bc3c1c0c3700a698f560766f597e13d6da7f54b41e03416f74a7ef30fc888a94b268769468370ff4b039238511037098b221ec
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mX:6MdkS6IsXkRX0bQEgYe709hJ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4624 set thread context of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82
PID 4624 wrote to memory of 1288	4624	156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe	82

C:\Users\Admin\AppData\Local\Temp\156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe
"C:\Users\Admin\AppData\Local\Temp\156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\156b477255424ad9d07d4d58e07711f2b8e491393eda76116d984e6a9549e9fb.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1288

memory/1288-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1288-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1288-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1288-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1288-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download