8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:19

Target

8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
Size

83KB
MD5

a0f3cc25304402c3cde7161af0538166
SHA1

55c4094b2c46ed8a1aa0898a899e9daeb3418e75
SHA256

8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18
SHA512

81b87f8b2555ccb47c8f09e5649962960ea1cfd12ef727d4b52f643149dbcd62fcbd0093e77bc973156aec136fcd808fe7b7edd671d3d886c7283ecbb0515bd1
SSDEEP

1536:jw1xfNaOnq5Pnit0sxOHSiPHyrRuGq0E3KWFP2lJC3WrqZ:0aUqVit0nHLIS+PCGuZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80
PID 5012 wrote to memory of 2080	5012	8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe	80

C:\Users\Admin\AppData\Local\Temp\8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
"C:\Users\Admin\AppData\Local\Temp\8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
  C:\Users\Admin\AppData\Local\Temp\8bb2967d921ba6bb6d449df17be9e1973834c3180c7f521f5eb5f962581bdc18.exe
  2⤵
  PID:2080

memory/2080-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2080-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5012-135-0x0000000002260000-0x0000000002264000-memory.dmp

Filesize
16KB

Download