30dbaf93bd336570f902dba0d258a8647f4e97e73974f1765b025098b16c6748

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 03:03

Target

a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
Size

108KB
MD5

a0c6f5d3aef11b3bcb53dc4bcffb0868
SHA1

a73633141f87abe09d35a83700725a2d9aa8747a
SHA256

30dbaf93bd336570f902dba0d258a8647f4e97e73974f1765b025098b16c6748
SHA512

63a183c39f9f20c8e0ee923d4f24ac5c3135c518bfb941cdd25093f3b071631e1fb2d8a540ad384e4ba1c6767e2ccbb2f866de29ccc8e6a8c9264f3786f9302c
SSDEEP

1536:q6ujHq0yENFaJEaxCZaYTCEewnZ1sglRsbmoQKFSVjOzNha5z5N1NMDsMs8K:qne88EaxwaZE5zVWmPKFSUzNCz3ssb8K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3340 set thread context of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
2932	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86
PID 3340 wrote to memory of 2932	3340	a0c6f5d3aef11b3bcb53dc4bcffb0868.exe	86

C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
"C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
  C:\Users\Admin\AppData\Local\Temp\a0c6f5d3aef11b3bcb53dc4bcffb0868.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2932

memory/2932-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2932-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2932-10-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/2932-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3340-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3340-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3340-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download