5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6

Analysis

max time kernel
185s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:59

Target

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
Size

392KB
MD5

52f59dd7abdc7d2ad8f9edc0339cd5a0
SHA1

cd1782837054fbddb6ed1d18b21b0b704eeba3dc
SHA256

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6
SHA512

4f11995fa359b48d556044fa562e174ce5488f2a2466021fa466a0fe46657ddf39aa941a6c4a5bab72a4c7fc143b8eafad555107bd2a9ffa52e3f17528806489
SSDEEP

6144:ai/OL0Y3KrTijm7FQ0EfjUsb5QthoqCgD1H1M9m7AeEEAaR3jbtAert92vCgb+WH:auOAY3KrejAFQBrUsAoELcdEAadOer

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

pid	process
5064	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
5064	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

description	pid	process	target process
PID 4648 set thread context of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

pid	process
5064	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
5064	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

pid process

4648 5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

pid	process
4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

description	pid	process	target process
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe
PID 4648 wrote to memory of 5064	4648	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe	5eb53dffac18fe36133222c58cd1e00fd4c16bc3d1476e130e0df40c809e2ce6.exe

C:\Users\Admin\AppData\Local\Temp\tmp79B4.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7A32.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
memory/5064-137-0x0000000000000000-mapping.dmp

Download
memory/5064-138-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-140-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-141-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-142-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-144-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-145-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5064-148-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download