4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 03:13

Target

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
Size

1.2MB
MD5

c64ea5937774ace6de198b245896d2c2
SHA1

af0a99e43617739785d218a752af632bad684eb7
SHA256

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83
SHA512

84754c2aece423f2e2b7341831421eda425702d6aabddc32c110182ff765f669d7c14310de63b6f7f118717574d48ed68071a01b7574bb538a70b9c1b3599513
SSDEEP

24576:7NNY5NNkYBgQtbqGDo4s/n8CeSovyre6qFPNocSY:7NNyNNkYBntrDds/byKreZ1KcSY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

description	pid	Process	procid_target
PID 2276 set thread context of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

pid	Process
4844	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
4844	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

pid	Process
2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe

description	pid	Process	procid_target
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79
PID 2276 wrote to memory of 4844	2276	4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe	79

C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
"C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe
  "C:\Users\Admin\AppData\Local\Temp\4c49b9811b5cf60e0091d6143b6e7be20ff459e9160ba2c3246c062b75f53c83.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

memory/4844-134-0x0000000000000000-mapping.dmp

Download
memory/4844-135-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4844-136-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4844-137-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4844-138-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4844-139-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download