9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff

Analysis

max time kernel
185s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:36

Target

9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
Size

70KB
MD5

bf9134c1b611f58d180b763769e86cf4
SHA1

0e097a9b6d7710ad490f68c40684986df2b850f2
SHA256

9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff
SHA512

164a287ab6f296767a1cebcbc88ffea75b20e5d5875452845e329699c80141e9d983e5b65162141674ff9f244f07468ff5b2e5053eaddac3280fcdf2c45ae1c1
SSDEEP

1536:HqiN2G50ffaX+Hv99DJYL2TvQJBAUFkDegvNeFjm0AJMR:Kk350XbHFzjTvScegvqjS+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
3288	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82
PID 1476 wrote to memory of 3288	1476	9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe	82

C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
"C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
  C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3288

memory/1476-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1476-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3288-141-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/3288-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3288-140-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/3288-139-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/3288-142-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/3288-143-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download
memory/3288-144-0x00000000006D0000-0x00000000006E0000-memory.dmp

Filesize
64KB

Download
memory/3288-145-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/3288-146-0x0000000002090000-0x00000000020A0000-memory.dmp

Filesize
64KB

Download
memory/3288-147-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3288-148-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download