51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 12:50

Target

51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
Size

1.3MB
MD5

5151ae79cd70cba3421f859ef3e51375
SHA1

0bfe5fcda847f48a7c6141ce5968ef92122c3be1
SHA256

51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4
SHA512

b23cbbe8e0fcd38a2c2ac73ff2519b3f63b92f5edbe8915c721e1d89b0c2893e8de4a2086a5dd92432c632a0412142f6aae93775108c3585f948f667a357856a
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaky:zrKo4ZwCOnYjVmJPal

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4840 set thread context of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4772	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
4772	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
4772	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
4772	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
4772	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82
PID 4840 wrote to memory of 4772	4840	51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe	82

C:\Users\Admin\AppData\Local\Temp\51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
"C:\Users\Admin\AppData\Local\Temp\51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\51e3f923dbb4d4b9e3d7d0147ef0da3d3f2e34094c66338746be3193ae6ff4f4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4772

memory/4772-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4772-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4772-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4772-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4772-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4772-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download