e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83

Analysis

max time kernel
112s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 10:11

Target

e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe
Size

1.2MB
MD5

364b5329eaf91bdf78e21991984e1583
SHA1

8b6d889a8bcb154642d4daf0b801c414075c00bb
SHA256

e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83
SHA512

e11cacd53c24d6c1a239a6917cec60763c8e33d7ac9461344f17469136dac8c0b6fff39e2dab3d55bc40f81d9da65f8d74aafc3a65ee73798cce90642460ea1a
SSDEEP

12288:tSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfbH:sxw8wFDY3wE3wY6cxI6gWUbIwMLHf/+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81
PID 4820 wrote to memory of 4864	4820	e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe	81

C:\Users\Admin\AppData\Local\Temp\e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe
"C:\Users\Admin\AppData\Local\Temp\e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe
  "C:\Users\Admin\AppData\Local\Temp\e78d981d9099f44a135842d6b39da3263e0ba73523947e38b58a8ef772643d83.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4864

memory/4864-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4864-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4864-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4864-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4864-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download