51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac

Analysis

max time kernel
146s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 18:25

Target
51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe
Size 228KB
Sample220919-w238bscdb4
SHA256 51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac
MD5 5484087153f0541ca98be3de4528c2b1
SHA1 80c5158ef1890ed46fb5c9c57d47d210367ddbad
SHA512 31de971104fc149c6530233441c961c5a7a14c8b7634d6ed045b7e505d7958a15fdd483c07717d3f63a6d8d6a3f4b677aa87b43a03123b88eb6bb580c6bbdb83
SSDEEP 3072:x/LehSAHwXFT8aBznRovD3PCWcTAI0fJtgiln7EQ2wqI0xTjkwunovGUH8yIp:0Ha4aJnEbccLfJTn7mTunow
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80
PID 916 wrote to memory of 2200	916	51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe	80

C:\Users\Admin\AppData\Local\Temp\51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe
"C:\Users\Admin\AppData\Local\Temp\51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe
  "C:\Users\Admin\AppData\Local\Temp\51f7e66871ebf9a5a1b018e853749a6225938b819ea325f4f1d45b50273c71ac.exe"
  2⤵
  PID:2200

memory/2200-135-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/2200-137-0x0000000000400000-0x0000000000427000-memory.dmp

Download