760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87

Analysis

max time kernel
132s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 10:05

Target

760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
Size

640KB
MD5

65eca2b95c589d6f0bc36afa4e932bbc
SHA1

326abb986f87f3ab5a89c206f2a5fe2bb0e4efce
SHA256

760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87
SHA512

dcc4dbfa1d9bd2de749fdad38407217c7bf9e7cb2d6a0682d57628566f34c008e49259e9dcd82066f891008c71373d86ebfd5bd084f06c51dce552d84dbf447f
SSDEEP

12288:pYTACouoxfilVzYKj86sZ4JySsy3VesuOdVAy3oCvC1i+5qGHSCGhJdkVWaK:pYTACSfilpYO5bBeCXT3oCvC1H5LSPhR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe
2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 1960 wrote to memory of 2264	1960	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	81
PID 2264 wrote to memory of 372	2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	25
PID 2264 wrote to memory of 372	2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	25
PID 2264 wrote to memory of 372	2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	25
PID 2264 wrote to memory of 372	2264	760197e18380172db0b33a3335bd45fa5ff077fc3201db4da6b137d1bbd96b87.exe	25

memory/372-142-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1960-132-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/1960-138-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/1960-139-0x0000000002360000-0x0000000002369000-memory.dmp

Filesize
36KB

Download
memory/2264-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2264-140-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2264-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2264-143-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download