93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3

Analysis

max time kernel
146s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 21:46

Target

93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
Size

1.3MB
MD5

b1566236181643e36c39cd765bbef6fc
SHA1

6ad651ac984afdb759e37d1895a5bcbe2b856078
SHA256

93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3
SHA512

ceb6608c8946fe1157240743d04aac4fc3659959c559b910d7430029f6174d3f6980ce45ab3d2cc9515e2c8b169c221cdfe3ec60ed7b06a7b37297b9da12f811
SSDEEP

24576:8etyVM24XFiG1OE3gsbqCKAu+QzbIEJ/PXphheyMSlNzGtV:vf71R1fw6/u+7MP15+tV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 1804	220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe	86

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1804	220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe	86
PID 220 wrote to memory of 1804	220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe	86
PID 220 wrote to memory of 1804	220	93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe	86

C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
"C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe
  "C:\Users\Admin\AppData\Local\Temp\93508d80f6048497e79e271dd5d23dbb79855e9c9c7585c6b7927ac5577583e3.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1804

memory/220-132-0x0000000002320000-0x0000000002325000-memory.dmp

Filesize
20KB

Download
memory/1804-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1804-137-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download