618a3e8104c32a9f840c7879a795d77aba89804a69681c629d2065471f9dbdbc

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 05:16

Target

88a6ce9b0f91c666531024957298efb2.exe
Size

55KB
MD5

88a6ce9b0f91c666531024957298efb2
SHA1

b80d63d0a34f815ce21de08c9285994192a276fd
SHA256

618a3e8104c32a9f840c7879a795d77aba89804a69681c629d2065471f9dbdbc
SHA512

3bb0652985b4bec452b6fb7e3e2943e9e427570ef9e7e64a7d32e704a4346dd757299b2703526c4a78574cbd3c0c8a782e82df2d3584dca4d34247acf91ff246
SSDEEP

1536:ZdxtHvczlNVceuiqPO9ptt7IV5lwIPM+0LJ6pga:BtH5iqPmptCVLPOI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4332 set thread context of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	88a6ce9b0f91c666531024957298efb2.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84
PID 4332 wrote to memory of 1048	4332	88a6ce9b0f91c666531024957298efb2.exe	84

C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.exe
"C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.EXE
  "C:\Users\Admin\AppData\Local\Temp\88a6ce9b0f91c666531024957298efb2.EXE"
  2⤵
  PID:1048

memory/1048-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1048-5-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1048-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1048-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1048-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1048-10-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/1048-11-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4332-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4332-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download