8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:53

Target

8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
Size

364KB
MD5

6f5cecc68ca87df004cbfdc69a2d7b1f
SHA1

a8a1b7fbc78ea598adb13d7597f93e1837976475
SHA256

8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266
SHA512

df4825eb8530c2faf10fd2ec850361e0d16015f29d01442e5817d3c794c7bb8e100fccd1df0f0058334a97025de2941911ad035e19e9f0f132576cb4359c9f42
SSDEEP

1536:7ILMJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6wE4ifCKQ:EAX0e1FB/DpKjCLHAE4t1e1vbi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80
PID 2228 wrote to memory of 1584	2228	8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe	80

C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
"C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe
  "C:\Users\Admin\AppData\Local\Temp\8b0043c407c9848f8366fab86e62d6e98a39cd304ad0eed9b071269f59fd9266.exe"
  2⤵
  PID:1584

memory/1584-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1584-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1584-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download