ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06

Analysis

max time kernel
202s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 09:57

Target

ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
Size

1.3MB
MD5

9cb782a7bd4e5af91936de512b9f07a1
SHA1

ae8d5441ac5dc695f86dd4f345eafa77564d90fb
SHA256

ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06
SHA512

3342b8df1b1d679b1b49fbee4adfdf0a78bac27b9fd435d54f0accc8186afccbf68b9d8dba549bb82bb6cef78ab3c69843d798c0b7d822a344ab9cec8ad68f41
SSDEEP

24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakR:brKo4ZwCOnYjVmJPa6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3248	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
3248	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
3248	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
3248	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
3248	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82
PID 4448 wrote to memory of 3248	4448	ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe	82

C:\Users\Admin\AppData\Local\Temp\ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
"C:\Users\Admin\AppData\Local\Temp\ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\ea40a345ee35fdd874112ae4f0b3925d6dae3f3a9c1d6382fc5da41bb1107a06.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3248

memory/3248-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3248-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3248-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3248-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3248-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3248-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download