0ae1a08bb5020d41a5e8edfed251264a1bb0739c6d8a0f5b33a0c11ae4d9d98b

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:46

Target

1a761e3bc582bf8a4abf936dd91e0cd5.exe
Size

2.1MB
MD5

1a761e3bc582bf8a4abf936dd91e0cd5
SHA1

3789c7573a595f29d62ade5722416b3129bd9bf4
SHA256

0ae1a08bb5020d41a5e8edfed251264a1bb0739c6d8a0f5b33a0c11ae4d9d98b
SHA512

16e028806ba3984f39a0cde3b7107b89b66138b04b9974f89227e3ae78c891f5064def0a7b790699d846b40869fce9ca1217291944037e08e84e958710b01ba4
SSDEEP

49152:dMgEq3yNTjDR8tcwnbvYe8NrT86/OY5AINa1zgQfTx/zCUcZ7ruUOHM8:dkRf+WEzgQ9/v3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4792 set thread context of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89
PID 4792 wrote to memory of 232	4792	1a761e3bc582bf8a4abf936dd91e0cd5.exe	89

C:\Users\Admin\AppData\Local\Temp\1a761e3bc582bf8a4abf936dd91e0cd5.exe
"C:\Users\Admin\AppData\Local\Temp\1a761e3bc582bf8a4abf936dd91e0cd5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\1a761e3bc582bf8a4abf936dd91e0cd5.exe
  C:\Users\Admin\AppData\Local\Temp\1a761e3bc582bf8a4abf936dd91e0cd5.exe
  2⤵
  PID:232

memory/232-3-0x0000000000400000-0x000000000061A000-memory.dmp

Filesize
2.1MB

Download
memory/232-5-0x0000000000400000-0x000000000061A000-memory.dmp

Filesize
2.1MB

Download
memory/232-7-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/232-6-0x0000000000400000-0x000000000061A000-memory.dmp

Filesize
2.1MB

Download
memory/232-8-0x0000000000400000-0x000000000061A000-memory.dmp

Filesize
2.1MB

Download
memory/232-10-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4792-0-0x0000000000400000-0x0000000000626000-memory.dmp

Filesize
2.1MB

Download