4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831

Analysis

max time kernel
358s
max time network
478s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:28

Target

4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe
Size

147KB
MD5

1692239ec0f4902a4c7af04f5f410080
SHA1

6e2fd9f6fdc670f5cee252f60579c060bf97cdcd
SHA256

4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831
SHA512

29df2403ac50c9e4baff0157a80b3fa734657e6eff479272312832997b48d4d2ff0eddb4ae6968221150a5fc2a548aeb8cf6187d8f7687b605e6cd236d9ebf57
SSDEEP

3072:B56HRt8BdiEICv2gHcKlb7spLfQvmc6RV8:uRrhe9sV9c6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe
2292	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81
PID 4912 wrote to memory of 2292	4912	4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe	81

C:\Users\Admin\AppData\Local\Temp\4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe
"C:\Users\Admin\AppData\Local\Temp\4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\4341168de78d019ee7b5f79abe33eef14b80e8bb6894290ccc6abd475ee65831.exe
  71
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2292

memory/2292-135-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2292-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2292-140-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2292-141-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download