9b9272a79121c2d73fa0b6edc48d64096fa7c45f1790fce4bb2eae638de17790

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 10:32

Target

be628ff2a754880125f3db752a1cb6a2.exe
Size

852KB
MD5

be628ff2a754880125f3db752a1cb6a2
SHA1

a58a08a6d1b15c74a5fc8d6ebb7a28ba34588749
SHA256

9b9272a79121c2d73fa0b6edc48d64096fa7c45f1790fce4bb2eae638de17790
SHA512

0c5fa02605845d2dd96e688aa99f5b74de5c84b5212932c6444d99628d11b77fa6148ef635796289772c5552b5b83d249f91ef19186e918512734cea4e1916fe
SSDEEP

12288:Ny4HdZuJ6X6Go7YNQw1F85ZwKd89BcF8vjBplYXNpbycdc9vMFmshsJLmxPLy:NPpSwQoyEvOKdpEcVImFLmxG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1872	be628ff2a754880125f3db752a1cb6a2.exe
1872	be628ff2a754880125f3db752a1cb6a2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92
PID 1872 wrote to memory of 2964	1872	be628ff2a754880125f3db752a1cb6a2.exe	92

C:\Users\Admin\AppData\Local\Temp\be628ff2a754880125f3db752a1cb6a2.exe
"C:\Users\Admin\AppData\Local\Temp\be628ff2a754880125f3db752a1cb6a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\be628ff2a754880125f3db752a1cb6a2.exe
  C:\Users\Admin\AppData\Local\Temp\be628ff2a754880125f3db752a1cb6a2.exe
  2⤵
  PID:2964

memory/1872-0-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1872-7-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/2964-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2964-5-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download