ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa

Analysis

max time kernel
95s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 09:32

Target

ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
Size

1.3MB
MD5

f57589a5527b067c56d779015aa90b58
SHA1

95ade55385c2f2e1984da4e714f377feb7bd4a34
SHA256

ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa
SHA512

ac1761dd89de13b221ef083b878d94aafb205dd27955ddd6bbcf7a68c5fba70a3b6d7ef34af5f15213b51344fe8dbb97974767b3e079df1b839f82662cf353e8
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:rrKo4ZwCOnYjVmJPat

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1224	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
1224	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
1224	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
1224	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
1224	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79
PID 1064 wrote to memory of 1224	1064	ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe	79

C:\Users\Admin\AppData\Local\Temp\ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
"C:\Users\Admin\AppData\Local\Temp\ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\ee9f8f43dd89347d23608c76f3c1f6ebb93ea3dd9e97b3a2213b68873c1ff4fa.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1224

memory/1224-132-0x0000000000000000-mapping.dmp

Download
memory/1224-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1224-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1224-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1224-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1224-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1224-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download