cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc

Analysis

max time kernel
189s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 10:08

Target

cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe
Size

892KB
MD5

a0919d3458b79be451820349e925c686
SHA1

2c4d170683ceca30977c127594c485f9a36e24d3
SHA256

cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc
SHA512

cca3460d0abbde6d591b925f78584f4fa26ab04a343e6c5c28ab3c77d38d5b18f4fd1fa3e5e90056675c74bac283e2f4f5162ded73e6136b28e66c716c3e7cbc
SSDEEP

3072:m6KloQSrkKgRENEI5apGTwQqVMTW0hiJD8gzZDhY8Ema5f2vL8RFpV60UfB1ZDhI:mZZWma5fBQHZWma5fBgAwdJm65fe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81
PID 4952 wrote to memory of 4816	4952	cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe	81

C:\Users\Admin\AppData\Local\Temp\cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe
"C:\Users\Admin\AppData\Local\Temp\cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe
  "C:\Users\Admin\AppData\Local\Temp\cf2376afe290b296e1acbffa1875787ebc4224e393843584b2eed09f8d2cb6dc.exe"
  2⤵
  PID:4816

memory/4816-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4816-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4816-140-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4952-132-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4952-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download