5c70f741e2ee2450be59fc5a5abab5a52f5de8716d9788588f10a080c4bbfd6b

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:49

Target

130fcc9e8e48d38e010d6dcb4e2cff68.exe
Size

76KB
MD5

130fcc9e8e48d38e010d6dcb4e2cff68
SHA1

1c436c0c4f0311197f04d5f21b92428800f4cf7d
SHA256

5c70f741e2ee2450be59fc5a5abab5a52f5de8716d9788588f10a080c4bbfd6b
SHA512

9ad77931efa08303b8f35a3d8ab90bf83f2be3fc1c11458c911e3307575d9aa25a4eb2038b0013ebd289b15fa2b426edf8385a637f9d97f644bfb03acdeab92f
SSDEEP

768:zf8SwcJWbh1GFLfX74ihZ4wFIYg2Z+iWnOZE7F0LyhspOtE77:zscJkoFLP7BZ4OIdABWl0L6q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 728 set thread context of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
728	130fcc9e8e48d38e010d6dcb4e2cff68.exe
1016	130fcc9e8e48d38e010d6dcb4e2cff68.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89
PID 728 wrote to memory of 1016	728	130fcc9e8e48d38e010d6dcb4e2cff68.exe	89

C:\Users\Admin\AppData\Local\Temp\130fcc9e8e48d38e010d6dcb4e2cff68.exe
"C:\Users\Admin\AppData\Local\Temp\130fcc9e8e48d38e010d6dcb4e2cff68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:728
- C:\Users\Admin\AppData\Local\Temp\130fcc9e8e48d38e010d6dcb4e2cff68.exe
  "C:\Users\Admin\AppData\Local\Temp\130fcc9e8e48d38e010d6dcb4e2cff68.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1016

memory/1016-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1016-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1016-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download