fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70

Analysis

max time kernel
150s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:34

Target

fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
Size

277KB
MD5

b1b984e85b4667d31b07a4a0fbef6615
SHA1

1a2a7f155fa4d4eaef49c58b8077d2a0ec03f14b
SHA256

fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70
SHA512

383d0ff24eb4cf38b6ed3e1d434b3e9800a8313558b96b387f7ef1483accc67af9c264298c88a19c04449b5843933c68c969b1bf861ba4cc0d3280617fdd92b3
SSDEEP

3072:hAp7lLCT7mstYeQSkPYxz29Gdk6Stx/KqiOvDCH1M2ZyeqAiLGI2ud+3OFyBUII:hARlLCT52WsGd3eiqvDCC2nJR3OmUx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80
PID 4556 wrote to memory of 4684	4556	fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe	80

C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
"C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe
  "C:\Users\Admin\AppData\Local\Temp\fc16b38eb9661e5bfe0e9b6c29201ba79eb8051f025007ec140b5a8893a2cc70.exe"
  2⤵
  PID:4684

memory/4556-132-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4556-138-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4684-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4684-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download