48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 13:23

Target

48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
Size

1.3MB
MD5

19ea357cfa52aa919ccf246996f396b9
SHA1

edbb8b855c85fc41ad0b8c1cf0f477bbc51cf7af
SHA256

48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b
SHA512

5a9de7e6e918bdc68cf5751f12f8257bdd4a9d2eeff0013fb7a41a0e09db83669b567cb29020b52d610417e3cefca1e6e2a88a32c66a47ff4f2c87fde9696935
SSDEEP

24576:4OiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9:Ri1DWLFP53UGe76x0ZUphdt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4220	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
4220	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
4220	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
4220	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
4220	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83
PID 2456 wrote to memory of 4220	2456	48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe	83

C:\Users\Admin\AppData\Local\Temp\48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
"C:\Users\Admin\AppData\Local\Temp\48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\48d37991e1609ce0d6e75b4bcb9b663ec189bb7442165aef2b10b794286e905b.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4220

memory/4220-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4220-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4220-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4220-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4220-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download