59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4

Analysis

max time kernel
124s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:03

Target

59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
Size

1.2MB
MD5

30bd1d07e48b4dee95ec5329cec50b8e
SHA1

47517bc3dddb8d499e6952d138394ce65a024af9
SHA256

59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4
SHA512

d39f2106e3951d8780f48849b86ab0b956bf2cda23166ad35ea249ab60c62ed738f87f0b9596bb420a61892ded9817435f1e5cb1decc773733f1d60217e6bdbb
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mW:6MdkS6IsXkRX0bQEgYe709h4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1836	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
1836	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
1836	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
1836	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
1836	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83
PID 2224 wrote to memory of 1836	2224	59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe	83

C:\Users\Admin\AppData\Local\Temp\59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
"C:\Users\Admin\AppData\Local\Temp\59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\59ee8f54885a93d8735e6cc3f118935505e214c6b0f1fc3d4b030b713cfc92a4.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1836

memory/1836-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1836-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1836-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1836-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1836-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1836-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download