a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad

Analysis

max time kernel
189s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:50

Target

a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe
Size

252KB
MD5

594c43fae07794284103c8ce908bd964
SHA1

c29f1038c14ede185af7f7bc74fc17ad8cd2c0ed
SHA256

a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad
SHA512

36dbbcb4716b4147af7363b32cddbf6ee79598dcbc5cb7245960b8b2284e73115d24191bbfc92903757dbb091f9ddbd102c90454283a1476d5b9bc1dac6c64bf
SSDEEP

1536:/KyQMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ/B8x1J1j:PX0e1FB/DpKjCLHq8x1HHoI9ku

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83
PID 2992 wrote to memory of 3748	2992	a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe	83

C:\Users\Admin\AppData\Local\Temp\a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe
"C:\Users\Admin\AppData\Local\Temp\a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe
  "C:\Users\Admin\AppData\Local\Temp\a194c0a06987b9b849097c876da88a2d6dbdd72b6ab6475c30e022fc3c1dd6ad.exe"
  2⤵
  PID:3748

memory/3748-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3748-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3748-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download