0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83

Analysis

max time kernel
157s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 20:43

Target

0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
Size

1.0MB
MD5

eaf41abaad1594ed4ab028f16a432609
SHA1

0c65d419a4ef6f951e5d48770ff92ab0a2141a51
SHA256

0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83
SHA512

4d84b0c111a084e513986218494ffeaa6c7aece31eb0c23810cbe7eba8e849bdd369bf7d6e9d06f33178d88ecb4738d82d55b2216498be4bbb92c14cbffd7ab4
SSDEEP

24576:IJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpa:IWFPaXGalaCTt8XjwoGji8p

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4028	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
4028	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
4028	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
4028	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
4028	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85
PID 5040 wrote to memory of 4028	5040	0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe	85

C:\Users\Admin\AppData\Local\Temp\0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
"C:\Users\Admin\AppData\Local\Temp\0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\0e475ccbf7b2e9475b18fa1dabf13648cda685e4280f122062ec0c2319a0aa83.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4028

memory/4028-132-0x0000000000000000-mapping.dmp

Download
memory/4028-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4028-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4028-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4028-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4028-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download