8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747

Analysis

max time kernel
63s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 19:52

Target

8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe
Size

912KB
MD5

c83187b117d29065721a96ad93ca96b8
SHA1

edb3229ae51b73cfab710ba556dcae9ab9401e3a
SHA256

8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747
SHA512

0b54acf46221e09c9250f5b086a54b5697a94548981e6204f5fb49d11c03b5deeb16257e83463b346842aabd8ce8c6dae16362363e03ba4d0e5ad5ed7e69017f
SSDEEP

6144:yKXKhB6wLw1UZd0m04VTy76ozanqpTLBcMnD5Mgno:yqKbgAd0gVuOo8qpTLBr5ro

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80
PID 1048 wrote to memory of 3404	1048	8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe	80

C:\Users\Admin\AppData\Local\Temp\8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe
"C:\Users\Admin\AppData\Local\Temp\8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe
  "C:\Users\Admin\AppData\Local\Temp\8ebfb35b631f39d2b4aff38a3c3ad6f3d76acfa4511e3a4836792c460da33747.exe"
  2⤵
  PID:3404

memory/1048-132-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1048-138-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3404-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3404-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3404-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download