961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:10

Target

961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe
Size

184KB
MD5

6b0ca3ba0e0d7ab0cd8f9cf03a49c019
SHA1

8e8a040108398b07583c100b0e71a4b31cfd71a5
SHA256

961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4
SHA512

e519c52df9a6d8126791a66568a7915b6881eb5208245c558c2cebd2d5d6e1c9d2882ed15ba2ff59c35c96692a6f1a0b05f2bdbcde57fbafdcb7a83f9ce26796
SSDEEP

3072:SJA79SdSVhSzr3jAP7aCxr+xHmvIRHd2ALE6W9UT:UQ9wS2/o73xqxGvIzcV9U

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80
PID 1608 wrote to memory of 3444	1608	961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe	80

C:\Users\Admin\AppData\Local\Temp\961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe
"C:\Users\Admin\AppData\Local\Temp\961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe
  "C:\Users\Admin\AppData\Local\Temp\961c1e009e60b262ef6e6c04a8ad2283d51b92a346c1dd94e8cb5b20081b70b4.exe"
  2⤵
  PID:3444

memory/1608-132-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1608-138-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/3444-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3444-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3444-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download