934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:43

Target

934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe
Size

244KB
MD5

aded38678398c15de7def7aca630d42c
SHA1

c4d4b32ff6c6c19601c183f5a0a13ac2f6d03de8
SHA256

934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef
SHA512

115e3c478e75e84438bd86470c0c769d901c4ed5867fbd6bedaaaf641a456c8cac19fd6f48841291ad9be7758f6c896d0a14b7df9c98dd63a15d472296303390
SSDEEP

1536:8N1MJ249icel/Z01/NBX4UDpegM3zwACUJGLq42GrElP2T/1oHd5RVJ6wmBSpOq+:QaX0e1FB/DpKjCLHAm8pObv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 796 set thread context of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81
PID 796 wrote to memory of 1428	796	934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe	81

C:\Users\Admin\AppData\Local\Temp\934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe
"C:\Users\Admin\AppData\Local\Temp\934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe
  C:\Users\Admin\AppData\Local\Temp\934d8f228ea77eecdff478bb11a297956faa6074cbf5c31cb3843d265c85a1ef.exe
  2⤵
  PID:1428

memory/1428-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1428-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1428-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download