6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251

Analysis

max time kernel
6s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 15:51

Target
6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe
Size 170KB
Sample221029-tagh5sdgdr
SHA256 6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251
MD5 0203bde129879fa5ba8d3ab9ad6abb74
SHA1 7dffe9deaf77c7ac836a001df7569da951ab3771
SHA512 6cf0d6d6654f03fd0965bc168f5998ba219d6da81139ab750f3069d3b91bce06e490be6047cdbae3e1ac6f3f691f0a427fee946499cf1e139b5e499fe6478b21
SSDEEP 3072:HbX2EUT6G/moZWK8DUAhHuP1k8ZjezsFtFk+k98/sp+HWjjye:7mLTgThKCWezsFtFHk9yscH2e
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	EXPLORER.exe
3812	EXPLORER.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 4740 wrote to memory of 2732	4740	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	83
PID 2732 wrote to memory of 3812	2732	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	84
PID 2732 wrote to memory of 3812	2732	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	84
PID 2732 wrote to memory of 3812	2732	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	84
PID 2732 wrote to memory of 3812	2732	6da593d4dcf77b4f2845db36ebf3ace683a14e4bf26a43baa83ada67f0072251.exe	84
PID 3812 wrote to memory of 2268	3812	EXPLORER.exe	10

memory/2732-136-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2732-137-0x0000000000DC0000-0x00000000017C0000-memory.dmp

Download

memory/4740-132-0x0000000075320000-0x00000000758D1000-memory.dmp

Download

memory/4740-135-0x0000000075320000-0x00000000758D1000-memory.dmp

Download