e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e

Analysis

max time kernel
132s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 18:39

Target

e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
Size

302KB
MD5

823ede592dd1d0d7b564dd0bc45c119a
SHA1

36d17ae4de4b47f90b4288a785f02c60f021eaac
SHA256

e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e
SHA512

5c391584a8d8a43a29444de3ea463ba3d5682017442c0e848cbbb43d8344aab0e2e565d19669e9577143d9881953819b5cdf3f7c3f9c93e8fbcf1d841fe86ee3
SSDEEP

6144:2zm01fxxOUCjMOc+WjRSCnVW5GJZ2tNYLj8MfsBB+2Anva:2y037VzYKj86s3+23

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe
396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 4736 wrote to memory of 396	4736	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	80
PID 396 wrote to memory of 2576	396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	38
PID 396 wrote to memory of 2576	396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	38
PID 396 wrote to memory of 2576	396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	38
PID 396 wrote to memory of 2576	396	e5f4bb4dab3d465b2fc919313b0631fbc540c50a5d62af3878efbad607601a8e.exe	38

memory/396-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/396-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/396-141-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2576-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4736-132-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/4736-138-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download