768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:29

Target

768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
Size

198KB
MD5

82637dbf587766fb74cb8f56bd77141e
SHA1

c39ccaceed8dd70172d67eb87ea1a318c906f437
SHA256

768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f
SHA512

9b14b85583fbc031a643722ba1b4b9d55f5456702ca7511ac12dc21c44b41cedd02846d8257d599dfbf55ce631d0d70aa93f22cc4335c7117ff33b696a4e78ed
SSDEEP

3072:BrnCBUfF7FqrIu96HM0XUGXU2Fo21364EoiJeeI+StSqYLj8MfseR/l10ysFYCl:BDGUDKnVW5GJZ2tNYLj8MfsYl10ybCl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4112 set thread context of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe
3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 4112 wrote to memory of 3836	4112	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	78
PID 3836 wrote to memory of 2596	3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	54
PID 3836 wrote to memory of 2596	3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	54
PID 3836 wrote to memory of 2596	3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	54
PID 3836 wrote to memory of 2596	3836	768a17e6cc3e9f13cfe65ada25a3890b606bcb39a2eb7684cdef0fbac3c45a0f.exe	54

memory/2596-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3836-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3836-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3836-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3836-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4112-132-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4112-138-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download