37a026b8a5bfb273ffa6c3068cee3545991a675dba5202e3776a03b9f3e86c7f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 06:26

Target

2bae2aa615cfc51df99181b787558974.exe
Size

224KB
MD5

2bae2aa615cfc51df99181b787558974
SHA1

ae02f1e54fa2f357872e6451ab1c94148e479492
SHA256

37a026b8a5bfb273ffa6c3068cee3545991a675dba5202e3776a03b9f3e86c7f
SHA512

56595e72d99e822100ce08450b116058cb52f13d113d3c6ab82f3a14d08329c786ddbe7eb3b85ad9bc53a2af43616f8e6045124342799ea4ff92e82813f54e83
SSDEEP

3072:UyieC1GB5XPYzCFgegV5Hmry0S5p5BYpge1CzYPcBa/2m2Ob49:AVVd5p5Y/2wk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1356	2bae2aa615cfc51df99181b787558974.exe
1760	2bae2aa615cfc51df99181b787558974.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20
PID 1356 wrote to memory of 1760	1356	2bae2aa615cfc51df99181b787558974.exe	20

C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974.exe
"C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974.exe
  C:\Users\Admin\AppData\Local\Temp\2bae2aa615cfc51df99181b787558974.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1760

memory/1760-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1760-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1760-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download