2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 14:57

Target

2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
Size

1.3MB
MD5

c5007b01af50dc835c2743ece333b8d0
SHA1

50492a14380c8f168d19200c66962936e85895c6
SHA256

2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba
SHA512

7bf31fd9128cd94c7eacb3231d75789bc065178a4fa0b68accb9b6c159de5e2f7cb1401fc3715d953b118c0c4eabd7dbea2c8fb0e0291a720c9ee3c774ccd033
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakA:7rKo4ZwCOnYjVmJPaL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1276	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
1276	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
1276	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
1276	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
1276	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79
PID 1476 wrote to memory of 1276	1476	2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe	79

C:\Users\Admin\AppData\Local\Temp\2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
"C:\Users\Admin\AppData\Local\Temp\2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\2e58772b8dbdd0d62c0b8d30a3175c9fd6a4ca2686d69991934cf1ff5a3a01ba.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1276

memory/1276-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1276-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1276-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1276-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1276-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download