eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15

Analysis

max time kernel
172s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:21

Target

eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
Size

180KB
MD5

4982484d988615483ad64fc145418a2d
SHA1

0ceddbc14b9ad3a27eb0e54d71a8dd6e0df83dd4
SHA256

eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15
SHA512

2107304023d36d2f7cb314f7ad30224ce94abcc508ab5723d8fe943cd065705405be3f3189791bed0d72d530f8d5cbb1d0fa62b604b03ae977190ad1849c2a07
SSDEEP

3072:DaaSOGxbwwnN1+Vq8Zz9OmE8muDX8dgZl3/7ediYHqYJGBWzcJvHJ:Dq9Nwq8Zz9O+mo/7kzjJGBC4v

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 set thread context of 0	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 2340	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe	79
PID 1048 wrote to memory of 0	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
PID 1048 wrote to memory of 0	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
PID 1048 wrote to memory of 0	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
PID 1048 wrote to memory of 0	1048	eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe

C:\Users\Admin\AppData\Local\Temp\eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
"C:\Users\Admin\AppData\Local\Temp\eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe
  "C:\Users\Admin\AppData\Local\Temp\eca17ec995160fc8180d3870e5732c940fc7ad441c434aadbce70bb7a258cf15.exe"
  2⤵
  PID:2340

memory/1048-132-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1048-139-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2340-135-0x0000000000000000-mapping.dmp

Download
memory/2340-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2340-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2340-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download