e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2

Analysis

max time kernel
442s
max time network
465s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 10:12

Target

e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
Size

1.6MB
MD5

88ac34f68fc10c41a53f891d126cd6ab
SHA1

84bb9e76eb667f3a1fcfc551c65d571d5e9d8244
SHA256

e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2
SHA512

1373fa598c8c1eb2a05f61e8afe0d3faa93b58f16439f9bf5038dbdd5c80061920028da51e44846a4fbfa082a63d8005111c3a2cd18f3eb39b059c25c968c7ad
SSDEEP

24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYW:T6/ye0PIphrp9Zuvjqa0UidR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4368	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
4368	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
4368	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
4368	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
4368	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80
PID 1788 wrote to memory of 4368	1788	e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe	80

C:\Users\Admin\AppData\Local\Temp\e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
"C:\Users\Admin\AppData\Local\Temp\e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe
  "C:\Users\Admin\AppData\Local\Temp\e77c900054388ec96b579375c61f50b2dee52aedfdb1299f934d31f7c6f334b2.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4368

memory/4368-132-0x0000000000000000-mapping.dmp

Download
memory/4368-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4368-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4368-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4368-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/4368-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download