52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f

Analysis

max time kernel
185s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 12:47

Target

52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
Size

1.3MB
MD5

cf0082a35ef8aaa83ca5992c13ce072e
SHA1

412b1e1a5f1bcc3a12f6e30758195b783459e637
SHA256

52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f
SHA512

0e85a8853c861a0fec0a55c97040acdccec46af5f4ebd1753a699ad642d64e3a7095b32d883fc512319dd739688caa25746397f3a29b983fd4ce0249acf2141b
SSDEEP

24576:5DASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfgHZ:eSQtk2zQytkgis6yxiZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4896	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
4896	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
4896	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
4896	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
4896	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81
PID 228 wrote to memory of 4896	228	52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe	81

C:\Users\Admin\AppData\Local\Temp\52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
"C:\Users\Admin\AppData\Local\Temp\52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\52ad64466eb27354ad5afd1036d1c4dca73bc6fc6a165707a1e790bb81a2184f.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4896

memory/4896-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4896-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4896-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4896-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4896-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download