98af4220d3b20bdeec6a30276b82f2b8bd7777021063815148b5e7ac7c37a449

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 21:14

Target

b9ad63d096ba634d7f35bf78b96b5143.exe
Size

284KB
MD5

b9ad63d096ba634d7f35bf78b96b5143
SHA1

2a94977aca5563f5080f5b0d6d110ebe0cfaf8d7
SHA256

98af4220d3b20bdeec6a30276b82f2b8bd7777021063815148b5e7ac7c37a449
SHA512

1f73bbaf7e114b47ef47adf459a0182b549ba3a6db75c9a893e0c95b75e13c953a3fee97911feeca2482e53dcfd6c783fff11a191edbb9dc93af715f8c4fc62a
SSDEEP

6144:5gb8KnHWWb2raBCDorAB1c29F2WG6Ncy2w3hro:5g3BCraBiDisHxro

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3576 set thread context of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3576	b9ad63d096ba634d7f35bf78b96b5143.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89
PID 3576 wrote to memory of 3588	3576	b9ad63d096ba634d7f35bf78b96b5143.exe	89

C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
"C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
  C:\Users\Admin\AppData\Local\Temp\b9ad63d096ba634d7f35bf78b96b5143.exe
  2⤵
  PID:3588

memory/3576-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3576-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3576-7-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3588-4-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3588-8-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3588-6-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download