37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68

Analysis

max time kernel
128s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 14:22

Target

37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
Size

1.3MB
MD5

7cf205f9826e42d5195b9301b9333ac2
SHA1

3b90344da89a9e0994cda526b0583afc9023120f
SHA256

37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68
SHA512

615895802c7e53f9df33058a4be0c03caf32280ec1a02a5ed9d61aa878e6468890b257a4043bd5d953442ef70d8eeab762897f1164967423234c95d3cbe424df
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:brKo4ZwCOnYjVmJPaQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3676	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
3676	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
3676	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
3676	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
3676	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83
PID 4816 wrote to memory of 3676	4816	37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe	83

C:\Users\Admin\AppData\Local\Temp\37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
"C:\Users\Admin\AppData\Local\Temp\37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\37ee0581ec6c037bed83f3e3c57c2a50c6baa9fcfb2463508e0e3a9eb33d2e68.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3676

memory/3676-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3676-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3676-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3676-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3676-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3676-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download