ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa

Analysis

max time kernel
202s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:36

Target

ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
Size

1.3MB
MD5

6bb709620f581593420aaa052d153f2b
SHA1

f69c3d619d44e27d26fd1a5626b6ee81c573189f
SHA256

ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa
SHA512

bb2f509281ea726065d72042ee77cf86d431fd7fddbd95741f5c775ce88953ae9e3598d036ad6a2648d4befacdcee6213321232bd5b9182b622a6c51a98feece
SSDEEP

24576:HOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxe9Q:ui1DWLFP53UGe76x0ZUphdtH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4504	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
4504	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
4504	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
4504	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
4504	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83
PID 1672 wrote to memory of 4504	1672	ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe	83

C:\Users\Admin\AppData\Local\Temp\ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
"C:\Users\Admin\AppData\Local\Temp\ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\ee1b9b37896f77113239292d075ea6e1d6835aaa449e6fcdcf9a98fff6cafafa.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4504

memory/4504-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4504-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4504-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4504-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4504-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4504-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download