ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121

Analysis

max time kernel
135s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 21:58

Target

ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
Size

252KB
MD5

81fae35e4ec59eba286ec826f8b74450
SHA1

cb7a883454fa0f9368afc237e358207a141ebbbf
SHA256

ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121
SHA512

c1bb787cb2b01f245d6b0cbc614e1a56d1a40ccfcb5c26bc505a2d3841df7970021b3e4dd0db7805ebde65f79db2cc3969a55974f511018954b0def36e4509bc
SSDEEP

3072:/NtUqoKLZSYvoFkwc5+/7VZMF7ri4kM/WiNBhu3SVIeGFwe120Q7mr4kOplM4bta:ltUs/vukw4Q7uviCWiUPqsjAm0kOBbNe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5112 set thread context of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82
PID 5112 wrote to memory of 3396	5112	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	82

C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
"C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
  C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
  2⤵
  PID:3396

memory/3396-134-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3396-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3396-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5112-133-0x0000000002290000-0x0000000002294000-memory.dmp

Filesize
16KB

Download