e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 04:17

Target

e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
Size

1.3MB
MD5

1cf21221ce5cdb8f24790ca891a33686
SHA1

99cf4e5655412b4db6afdd0ff35d93fbc63452e5
SHA256

e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8
SHA512

56639d065e0bf5c6cec0510965d6698b6a4dc31b7ec60fe1f1ff064acad480d5e3672b758a2084f41d15d9edabe251ff5826c8f0d67da2e51e20b09368ab2275
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4984	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
4984	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
4984	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
4984	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
4984	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80
PID 1556 wrote to memory of 4984	1556	e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe	80

C:\Users\Admin\AppData\Local\Temp\e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
"C:\Users\Admin\AppData\Local\Temp\e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\e3f122f2d50a43c040aa1fdc5bf8658fcdbc66a2ef12df4bf0840c9d0551eeb8.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4984

memory/4984-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4984-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4984-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4984-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4984-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download