45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace

Analysis

max time kernel
161s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 07:22

Target

45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe
Size

1.3MB
MD5

fb37b5ce1517787eb7097ff5c8ef0aa8
SHA1

32594f8bd36773e301da0076685bf22e04b02fbc
SHA256

45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace
SHA512

23d1d61e4b44bad0e27a4bd7c8c7da79dfca8ae549a0a2231bc194eddff80b436d509fc5e545f468cf3a5875bccdbd5174bfec5ed82348e850b26001afef9dcc
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:jrKo4ZwCOnYjVmJPah

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82

Suspicious use of SetWindowsHookEx 5 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82
PID 5088 wrote to memory of 1240	5088	45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe	82

C:\Users\Admin\AppData\Local\Temp\45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe
"C:\Users\Admin\AppData\Local\Temp\45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\45e667089b43557042f8b47923060c48e32c21520881a58a3ed872b0674d2ace.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1240

memory/1240-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1240-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1240-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1240-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1240-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download