f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:42

Target

f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
Size

268KB
MD5

836b3594ba1b53c0fe9334aebf2b149b
SHA1

1803e4ff9f79d254e3f187aa6d2ef9ab43c70f1d
SHA256

f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831
SHA512

21fb0c666a501ab0bade3b2ee88dacde9928fc7401f0870a54417d60a4f1139392c4a9a9afcdde3826f49c65ef76c18466f9f7b7e3373449a01ce7c500631d72
SSDEEP

6144:khK6u1JtZ9Ggp2QDm3Oezv/ucx44bBnHavYZfYeeAF2U1lbLEn2m:khKvJYr/3OW/P44lnHagZfY0F2B2m

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe
2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 1272 wrote to memory of 2700	1272	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	79
PID 2700 wrote to memory of 376	2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	54
PID 2700 wrote to memory of 376	2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	54
PID 2700 wrote to memory of 376	2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	54
PID 2700 wrote to memory of 376	2700	f6e4a7171878fbb2ab566b941abbe6904bb108a9d6a2bebbfcedc0eb7dc55831.exe	54

memory/376-145-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1272-143-0x0000000000740000-0x0000000000779000-memory.dmp

Filesize
228KB

Download
memory/1272-133-0x00000000006E0000-0x00000000006E4000-memory.dmp

Filesize
16KB

Download
memory/1272-134-0x0000000000740000-0x0000000000779000-memory.dmp

Filesize
228KB

Download
memory/1272-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1272-139-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1272-132-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1272-142-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2700-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-144-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2700-146-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2700-147-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download