7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 10:17

Target
7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
Size 1.3MB
Sample221122-mbk5dshh37
SHA256 7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b
MD5 831303ac5255bb90f23236a1106d43fb
SHA1 89614421e1e86d5d37a36001158278003d52cf55
SHA512 c780c11e0b95717df635f33b32fcdc07ec083d6d091791a9d3ff33b4ebddf177640e51eacfdfda6e4b22fb53cf79a0420546f84a57ad37f545fed00391c9b579
SSDEEP 24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakw:zrKo4ZwCOnYjVmJPa/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5116	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
5116	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
5116	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
5116	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
5116	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79
PID 4236 wrote to memory of 5116	4236	7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe	79

C:\Users\Admin\AppData\Local\Temp\7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
"C:\Users\Admin\AppData\Local\Temp\7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\7e35d3409c1205d8f8e9c16b44c8ef5f0775746c64e49a092200e4bf5c4ee33b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5116

memory/5116-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/5116-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/5116-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/5116-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/5116-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Download