ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90

Analysis

max time kernel
145s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:49

Target

ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
Size

1.3MB
MD5

69607326040ba84fdf29c8cb9bdd2861
SHA1

3498ae2b00591bfd8e5dae7e367a6008d76d947a
SHA256

ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90
SHA512

904eafb3cdfd95e3ea78fa59ecbdf1047344458f82e59ea460e18b62e9dbfc818ff7e69ab3626f121f62645187a6ab29db3d7a26c7118b561641c924913a99fb
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:7rKo4ZwCOnYjVmJPa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5052	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
5052	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
5052	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
5052	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
5052	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83
PID 5112 wrote to memory of 5052	5112	ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe	83

C:\Users\Admin\AppData\Local\Temp\ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
"C:\Users\Admin\AppData\Local\Temp\ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\ebd17c3fd5992587e4dafe7d26252ec1f55a4095f0bdeb76e30c6813742e4a90.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5052

memory/5052-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5052-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5052-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5052-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/5052-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download