e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 06:26

Target

a6f6242f4fde096ff32f39f979e3908a.exe
Size

184KB
MD5

a6f6242f4fde096ff32f39f979e3908a
SHA1

66c525eb15c769e15f05c05070526433bb0f40b6
SHA256

e60c4c5bea96445219862ae85e388fcc287ab8a87726e4836db591222b419e73
SHA512

88f66679bcc493c4e77c6863311d2ccb332c52d54da7142005f2cff071aa37cff0be5c274deb859a01ba518f70e7d25ccee95cdfb77179305667ec525467c3b4
SSDEEP

3072:WsOo1ZyHi/jxlGKcEpbmALjoc06+4vC8KsPVsxcBWj77i:dOSZyHi/jNCn74vCoPVsxSWHO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

description pid process target process

PID 4148 set thread context of 2260 4148 a6f6242f4fde096ff32f39f979e3908a.exe a6f6242f4fde096ff32f39f979e3908a.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exe

pid process

4148 a6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 4148 set thread context of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe

pid	process
4148	a6f6242f4fde096ff32f39f979e3908a.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a6f6242f4fde096ff32f39f979e3908a.exea6f6242f4fde096ff32f39f979e3908a.exe

description	pid	process	target process
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 4148 wrote to memory of 2260	4148	a6f6242f4fde096ff32f39f979e3908a.exe	a6f6242f4fde096ff32f39f979e3908a.exe
PID 2260 wrote to memory of 3568	2260	a6f6242f4fde096ff32f39f979e3908a.exe	Explorer.EXE
PID 2260 wrote to memory of 3568	2260	a6f6242f4fde096ff32f39f979e3908a.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe
"C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe
  "C:\Users\Admin\AppData\Local\Temp\a6f6242f4fde096ff32f39f979e3908a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260

memory/2260-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2260-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2260-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2260-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download