419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 07:21

Target

419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe
Size

192KB
MD5

cc897738891e436295a34d9703e3b914
SHA1

53c5ad6195502bdd20d6a1947b7146cef515afa8
SHA256

419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31
SHA512

6a252966ee212f666548d78d69dde298ceae3a48e8c421582efd3f9699605ad50da5cafac4038f786dac48374850c761e8c95c9359db6f09b0b5d749798b5810
SSDEEP

1536:Ebnr66tIVXK+QmlHE79W22FP00DJPKh82+fCmosSpQU1+ekve5X:4rb/Y+7IXd00DJPrvfSsq19FX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE
1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE
1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE
1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1960 wrote to memory of 1948	1960	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.exe	81
PID 1948 wrote to memory of 600	1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE	27
PID 1948 wrote to memory of 600	1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE	27
PID 1948 wrote to memory of 600	1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE	27
PID 1948 wrote to memory of 600	1948	419a0a0a5873ddeb49333d7ae886bab3ddee01efd219dae7fbd119688f776a31.EXE	27

memory/600-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1948-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1948-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1948-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download