e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992

Analysis

max time kernel
152s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:13

Target

e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe
Size

1.2MB
MD5

3015cd11494269161ae60b05b8692ac6
SHA1

9bac612dcac7be5c55a25f29565be119d57aba59
SHA256

e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992
SHA512

47bfdaa89dd5bb5ae1242047fa9cbe7db1a96a6f82d068ae53cbdf806568ee779a437545fbd6680f8e8291579cb6b139fc67552d078dc8184ba47457814664b1
SSDEEP

24576:ECe9Oe9v9mKihqDftePGtlD75o1sfsNP0G3jXpaI9:EHO2v9mKihE6QDdMkOFam

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83
PID 4064 wrote to memory of 4960	4064	e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe	83

C:\Users\Admin\AppData\Local\Temp\e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe
"C:\Users\Admin\AppData\Local\Temp\e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\e44475e644dec5e6b029009730a1ea165e0155ff37ccb28a22f99488b1ea8992.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4960

memory/4960-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4960-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4960-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4960-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4960-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4960-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download