a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b

Analysis

max time kernel
123s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 19:30

Target

a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe
Size

308KB
MD5

0a18a7d583f5be75636a8e8a2fc7de0b
SHA1

2fcd5fb7ac26a437badfff5b6e0058692ad765a7
SHA256

a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b
SHA512

3f9c1b0be662e2fd42da6f76d0a48c86ba0c99a568f6e21f21d56cb28ec4687b224c89b80242b54866d9e10e284960d6fdcd12c7f66ed506c31957aab497d51b
SSDEEP

6144:pIhfHa2h6m2b3xXkoYDleErxfSOLx2fr8k16kkVVACMM:2p6Cp2xmDleErRkjb1Hk7+M

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe
3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 440 wrote to memory of 3052	440	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	79
PID 3052 wrote to memory of 2484	3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	29
PID 3052 wrote to memory of 2484	3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	29
PID 3052 wrote to memory of 2484	3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	29
PID 3052 wrote to memory of 2484	3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	29
PID 3052 wrote to memory of 2484	3052	a6e7215a28429bedb43c0c37a373ef897a26ae93e331612bb6a4edadf080653b.exe	29

memory/440-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/440-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3052-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3052-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3052-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3052-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3052-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download