8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637

Analysis

max time kernel
39s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:11

Target
8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe
Size 82KB
Sample221106-j3pecadffp
SHA256 8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637
MD5 093f7b7d1e971189f852dedcf490a590
SHA1 f1eea74e96120e95125eede9ba16247cd445b918
SHA512 e774d0ba741cd9fc1225aba8861ceebfb826148277e99d83fad62c8a0b79a2c8ff80da361bfbdb4f21bd322aa46e631d1b0bc42846acc891749025d56a012a45
SSDEEP 1536:ycp1JrVvxUXI3zetwnQg4bcoIa7+IPngFCSm4QPuUO/:yO1bxUXI3zRnQg4woIaTGCXPBo
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4364	winver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe
1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 1780 wrote to memory of 4664	1780	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	80
PID 4664 wrote to memory of 4364	4664	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	81
PID 4664 wrote to memory of 4364	4664	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	81
PID 4664 wrote to memory of 4364	4664	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	81
PID 4664 wrote to memory of 4364	4664	8c3ff42a9c57e52015f961b128857dfe5b428720b23a0d9092742239e7389637.exe	81
PID 4364 wrote to memory of 3080	4364	winver.exe	54
PID 4364 wrote to memory of 2628	4364	winver.exe	53

memory/1780-132-0x0000000002330000-0x0000000002334000-memory.dmp

Download

memory/3080-139-0x0000000000800000-0x0000000000806000-memory.dmp

Download

memory/4364-138-0x0000000001310000-0x0000000001316000-memory.dmp

Download

memory/4664-134-0x0000000000400000-0x000000000149A000-memory.dmp

Download

memory/4664-135-0x0000000000400000-0x0000000000404400-memory.dmp

Download

memory/4664-136-0x00000000018D0000-0x00000000022D0000-memory.dmp

Download