ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 07:52

Target

ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
Size

293KB
MD5

55a3e862725bf7084a7842005d95efe1
SHA1

cb3e8098dae09136e7be98218117a8abb54f1149
SHA256

ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742
SHA512

850e0860a84e57b44e7b38ee620cd06a219ab0fe55af7abe30f748da21e611ebc0ad4767aeed7847bf297f93b9703472b77e5f13c5dac88a4f01e93260f4a778
SSDEEP

6144:Zygsngid/o7iiEavto3NTwJXm6eFBbYEHRAvpKDYiex:Zyh3o7iiYRwIRBbYQRAvMYiG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82
PID 3172 wrote to memory of 3636	3172	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	82

C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
"C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
  "C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe"
  2⤵
  PID:3636

memory/3636-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3636-137-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3636-138-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download