ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 18:28

Target

ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
Size

1.2MB
MD5

0f7dc25a7570ce56e000a8aa0aa3a06d
SHA1

7f5d2ab5f296fa2e64796f4c4ff524ee2503d5cb
SHA256

ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58
SHA512

b4a18059cb139d85c01ba92f279590e0b62a9e404000561b2f5a56d32f33ff5f84b817f42dd1838be69458b3b38c906dfec7da536f03599216cfe552fc705139
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68ms:6MdkS6IsXkRX0bQEgYe709ha

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2304	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
2304	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
2304	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
2304	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
2304	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81
PID 4740 wrote to memory of 2304	4740	ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe	81

C:\Users\Admin\AppData\Local\Temp\ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
"C:\Users\Admin\AppData\Local\Temp\ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\ad7e68249c10ade8993fa5b91e51cd0d1f1da958c8e35dc42b17fb7a9ce2cd58.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2304

memory/2304-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2304-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2304-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2304-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2304-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download