ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:36

Target

ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
Size

1.4MB
MD5

008e70300ec8c2eba314af440e5102fa
SHA1

8772fc2946339b4fb5a916a4f383637820846d64
SHA256

ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70
SHA512

ed08a89a30e752a4aa65453eccfae7ed49be34c7dfd8d15eb29ca359277e1eddc38e78024492412caedf2c82e34b3e5324e045e7bf6558a2a4a3d66a77a0edbe
SSDEEP

24576:Ay83rXf95JRrVwk52X8DL2ZaVVk7FcAm6ycERLdDzUbBtEpZvj0j5Z:Ay8hFykeu2ZykaAJyrRZYBtEO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3268	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
3268	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
3268	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
3268	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
3268	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80
PID 880 wrote to memory of 3268	880	ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe	80

C:\Users\Admin\AppData\Local\Temp\ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
"C:\Users\Admin\AppData\Local\Temp\ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\ee2390d6fa122b66ddf56860952966c2aacc23d20f115dac0ad51732d23b1c70.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3268

memory/3268-135-0x0000000000000000-mapping.dmp

Download
memory/3268-136-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3268-137-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3268-138-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3268-139-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/3268-140-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download