22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397

Analysis

max time kernel
163s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 15:40

Target

22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
Size

1.3MB
MD5

a07c83ff73c6cfb33e62a96c57789946
SHA1

e44e0e83851ab4a5ac5f77f14526a624b79bc5ac
SHA256

22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397
SHA512

62526d4acd7a21e31d71873fb81c155fc6c2c75d115e3506e9320fc388421ebf3b978cf030ce7d7bd4e288bc3b3365568959d794d6cae6be2ec44df14a052af0
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakV:TrKo4ZwCOnYjVmJPai

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
260	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
260	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
260	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
260	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
260	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82
PID 4856 wrote to memory of 260	4856	22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe	82

C:\Users\Admin\AppData\Local\Temp\22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
"C:\Users\Admin\AppData\Local\Temp\22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\22a5e0c6fc965c9ee07f78c8aa3bc7eb2e1af3ca32ad53760de0e0834dec3397.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:260

memory/260-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/260-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/260-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/260-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/260-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download