e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 11:50

Target

e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe
Size

205KB
MD5

a2bd266b94aac0b10fa124c52adcec87
SHA1

9f4ae0d985cebc81a2851a0de261a62a2630549d
SHA256

e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc
SHA512

245755f18d75d20e468be80bd0cdab729b81a56702eee1fbfa08d2976bd4b3c3087dea26b9aa98821c63d52067e7037fbf1cbc686d93ef8ce2765471897664d8
SSDEEP

3072:hBI06yohsa6XLnxQ5h480DqBRhVh8njm9VCEGKH+YOMp7Ld7Gkcm/:hwb9SC2DqBRhVh8njm9VCwH+ep7Ld7Gu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82
PID 4716 wrote to memory of 1048	4716	e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe	82

C:\Users\Admin\AppData\Local\Temp\e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe
"C:\Users\Admin\AppData\Local\Temp\e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe
  C:\Users\Admin\AppData\Local\Temp\e4daa59c19d25fccc393d599cb54d21bde52b20cb222e7498e8d82b0ffae65fc.exe
  2⤵
  PID:1048

memory/1048-135-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1048-137-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1048-138-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download