5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 20:25

Target

5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
Size

1.0MB
MD5

04e125a92676fbeb44c3397123b53472
SHA1

eb6d1e8ce9151e84de0aad53cc8802a7e85661a3
SHA256

5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f
SHA512

c060bdb10d244938b5ddbed52de742cba23ed518bace76a5a6be3e1b83502cc2da22ac21c451a4ba3938911d1a7daf9804ca4733ae95f64490485389cb5c1cf5
SSDEEP

24576:4J0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpA:4WFPaXGalaCTt8XjwoGji8b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5072	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
5072	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
5072	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
5072	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
5072	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78
PID 1800 wrote to memory of 5072	1800	5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe	78

C:\Users\Admin\AppData\Local\Temp\5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
"C:\Users\Admin\AppData\Local\Temp\5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\5774f37671089d0ce195be5ff5ee23c9b185fe0a58fa8597772c8149db0c017f.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5072

memory/5072-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download