55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a

Analysis

max time kernel
168s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 16:22

Target

55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe
Size

1.3MB
MD5

176b2cfe77b3e5ce17ca4a095dbb9c04
SHA1

484ea293527016a38585ca3cf1df65baac253055
SHA256

55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a
SHA512

454b785632e055ea587a7ad13094e7180de1fc5223f48c3410abe42ee258de74d1d3d016c3efab605ff7345b74a0ecac1cc2f6fa39715614d67e07a07175071f
SSDEEP

24576:2KyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcu3:2KVzMNuwIKyoBmnMSURNQX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79
PID 3448 wrote to memory of 5020	3448	55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe	79

C:\Users\Admin\AppData\Local\Temp\55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe
"C:\Users\Admin\AppData\Local\Temp\55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\55485ef930cde3547b0b49e4be4a6a9c3d83e1c11e90105338f2f929b349614a.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5020

memory/5020-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5020-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5020-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5020-136-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5020-137-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5020-138-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download