557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec

Analysis

max time kernel
125s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 12:38

Target

557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
Size

1.3MB
MD5

93aec6e5a37fcffd1ea07677ef843caa
SHA1

86fc78ff0dd82e8b33bb3729664ff6c3e88ac22f
SHA256

557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec
SHA512

cac1e48c4e0ef9cff2ea8e601c2bc386d90ba0b57cab0a0215a12818916617b1bc37dec6163b53b9480f3a78d9813dfac98569aefd2ebf7a470b71c8eb7cd04b
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4960	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
4960	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
4960	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
4960	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
4960	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84
PID 2500 wrote to memory of 4960	2500	557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe	84

C:\Users\Admin\AppData\Local\Temp\557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
"C:\Users\Admin\AppData\Local\Temp\557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\557ce5144ab772020223fe9aada0945c2df7b911e83668ae18c4ec5ed602eaec.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4960

memory/4960-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4960-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4960-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4960-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4960-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/4960-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download