a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d

Analysis

max time kernel
281s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:19

Target

a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe
Size

225KB
MD5

e995fa5cd5756809d88e5e8b80737462
SHA1

0c5bb81380abab677dc5df39869a759e60f04f3f
SHA256

a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d
SHA512

9acc21832203ef868bbd64a549df67204ebda419f4eb363026f0618190b20eb62b2a79746f31f66dfdd051deaaf4862b8f44a404510bb65e6c1fba4f286377f4
SSDEEP

6144:vQfbCqSM4jao8e9DjKi1fX0IM3O6pcK+FqSLh:vQfbCqS3xhjdXJM3OEcK+YWh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82
PID 2904 wrote to memory of 4456	2904	a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe	82

C:\Users\Admin\AppData\Local\Temp\a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe
"C:\Users\Admin\AppData\Local\Temp\a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe
  C:\Users\Admin\AppData\Local\Temp\a161b5245b17e5432f80e6e6eb2b4f329fae02facca29edce996fee77c3c7f8d.exe
  2⤵
  PID:4456

memory/2904-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-134-0x00000000004B0000-0x00000000004B4000-memory.dmp

Filesize
16KB

Download
memory/2904-135-0x00000000020B0000-0x00000000020E9000-memory.dmp

Filesize
228KB

Download
memory/2904-136-0x00000000020B0000-0x00000000020E9000-memory.dmp

Filesize
228KB

Download
memory/2904-143-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2904-144-0x00000000020B0000-0x00000000020E9000-memory.dmp

Filesize
228KB

Download
memory/4456-139-0x0000000000000000-mapping.dmp

Download
memory/4456-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4456-142-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download