6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5

Analysis

max time kernel
84s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:43

Target

6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
Size

436KB
MD5

825e2c499a901f535d535479b44055a7
SHA1

100c38356f754c7af1bb4386b8160aebf81e0588
SHA256

6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5
SHA512

5d02b4aa421b6493210b74a28d025342950730bd42ecef671d2be5517b3fb45a64e5aaf3e97c60a2e4890634d195ee3b59e659f245edf3155702094a29dd9d6b
SSDEEP

12288:5HTMI4PwU2NMiy4POKlNVhP2YTUfq0rFvN:5zMD974mMNVhOhfqkF1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1156 set thread context of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 1156 wrote to memory of 4892	1156	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	83
PID 4892 wrote to memory of 980	4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	49
PID 4892 wrote to memory of 980	4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	49
PID 4892 wrote to memory of 980	4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	49
PID 4892 wrote to memory of 980	4892	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	49

memory/980-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1156-137-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/1156-139-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download
memory/4892-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4892-138-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4892-141-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download