e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb

Analysis

max time kernel
116s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 21:27

Target

e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
Size

596KB
MD5

a0b9612ddb0335666513cabf569bf070
SHA1

12aea834dac377f45ad6e9aab3995d386b61114b
SHA256

e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb
SHA512

cf85a41e3c6e3215e6e9bfb7150e5ebe2121dfeb041afdf63b7d930047ea1efb32f3114ddd45bfe710ede67a632e311918714cbb1d7f9b3e9b8adde5e6e5dc26
SSDEEP

12288:vG944dAqcN1ezI439EJPVXQTlqBzhnSB9Tht1:uqv2EJP1QxqBzhnSX9t1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 480 set thread context of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 2356	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	82
PID 480 wrote to memory of 2356	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	82
PID 480 wrote to memory of 2356	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	82
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 480 wrote to memory of 3824	480	e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe	83
PID 2356 wrote to memory of 5052	2356	cmd.exe	85
PID 2356 wrote to memory of 5052	2356	cmd.exe	85
PID 2356 wrote to memory of 5052	2356	cmd.exe	85
PID 5052 wrote to memory of 5004	5052	net.exe	86
PID 5052 wrote to memory of 5004	5052	net.exe	86
PID 5052 wrote to memory of 5004	5052	net.exe	86

C:\Users\Admin\AppData\Local\Temp\e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
"C:\Users\Admin\AppData\Local\Temp\e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\cmd.exe
  /c net stop MpsSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:5004
- C:\Users\Admin\AppData\Local\Temp\e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
  C:\Users\Admin\AppData\Local\Temp\e381cd817f171ad0f6a904872be6406ed208b7cffe8210bbd7642358238934bb.exe
  2⤵
  PID:3824

memory/480-135-0x0000000000C10000-0x0000000000C14000-memory.dmp

Filesize
16KB

Download
memory/3824-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3824-138-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download