3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 22:52

Target

3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
Size

385KB
MD5

639cdacd9a8484771605b7fbf98bb620
SHA1

8236ffb999192876c574d5a34dd4112ae191d121
SHA256

3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1
SHA512

84b42985214687bd7754b928aa6af1292545ccbea05110e996002b2741bdb3ae31b1236c0a6ed15338afbab22cf13fd3a7d99e0eee7d61c2e0230aee505b9747
SSDEEP

12288:M1qeRcFzfOPXnblev9ECfNjHmw0ptfqSa:MvkbOPnpe2kNjWTu

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4300	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
4300	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
4300	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
4300	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe
3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82
PID 3104 wrote to memory of 4300	3104	3cf9e6f11510210dc5c8dd5061efd40b182d261623a688915ae7674b418cadf1.exe	82

C:\Users\Admin\AppData\Local\Temp\tmp75B2.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp75D2.tmp

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
memory/3104-135-0x0000000002270000-0x0000000002274000-memory.dmp

Filesize
16KB

Download
memory/4300-132-0x0000000000000000-mapping.dmp

Download
memory/4300-133-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4300-136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4300-138-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4300-140-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4300-143-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download