e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56

Analysis

max time kernel
179s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:04

Target

e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe
Size

292KB
MD5

ccee2be1561d0c036649dc5b0289ae41
SHA1

6c627f9ce18c0a94d28331188033f8eeda976d92
SHA256

e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56
SHA512

5abcce037fd780a8cf7e8de9374df89632bc27838e1a9a86d80883b4fbecf7c400dbf7c1e240008aa7c296892d1b0aa24754a10276cc62912690d8396245ef69
SSDEEP

3072:xgzGckRd1rQRCj/7OM2y5UXvXlbWoSJh+IJF3VF:xgzGckigjay5OflbWVhV/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 796 set thread context of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82
PID 796 wrote to memory of 1860	796	e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe	82

C:\Users\Admin\AppData\Local\Temp\e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe
"C:\Users\Admin\AppData\Local\Temp\e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe
  C:\Users\Admin\AppData\Local\Temp\e0a7abfbcf32cfb07fce88a6fe8a2545c884465be25436d431be9987bbe28c56.exe
  2⤵
  PID:1860

memory/796-132-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/796-138-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1860-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1860-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1860-140-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download