e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675

Analysis

max time kernel
163s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 07:35

Target

e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe
Size

248KB
MD5

4f46417d626d4ce1e4dbf2f0aad05889
SHA1

7f66b52c3418b68f7675d84efac3cc1d5102a27c
SHA256

e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675
SHA512

4e5a2f2d2b52b412c1b5e6e67681417c656c74ab928fbe830e8b04b67af8d314504e4c0fa6b124137283c737bf63c0319e6f284653c19e9c6c7ca4549d02d92f
SSDEEP

3072:q2SAPvEjwY4FQE3hXJnVkmUtzg7ONeATtnJblE9+Uh74Ff7gaIKGr8YjU:q9jwbFQYhBVUVg7WFbl6tYU9ov

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79
PID 4912 wrote to memory of 4480	4912	e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe	79

C:\Users\Admin\AppData\Local\Temp\e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe
"C:\Users\Admin\AppData\Local\Temp\e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe
  "C:\Users\Admin\AppData\Local\Temp\e145ac4a00751d7085350631cac819b8add0114b66ce36af7fd0165fdeb4c675.exe"
  2⤵
  PID:4480

memory/4480-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4480-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4912-134-0x0000000000491000-0x0000000000493000-memory.dmp

Filesize
8KB

Download