18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 14:36

Target

18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
Size

68KB
MD5

06e5a7eb6c87337d3fc00bbfe23d11aa
SHA1

ae7f84bffd97240773bd0cec54d135487297285c
SHA256

18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe
SHA512

1a320b067698a099c5c36908be007147778c301f75e285aca7670becc4133db2d8481a3ff158be2d84906ab564922a973f6921837ea41d045dc380080b23f5ad
SSDEEP

768:bZdIE6mCf+51bcgBH5T9Zztj7CzrWBTZXDuT+pxvPDgAiXKZC2p2ng4nGwcsn6:9pFmg5Tf9u8TZXcCvfA2p2nNWsn6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe
4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4256 wrote to memory of 4900	4256	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	81
PID 4900 wrote to memory of 3036	4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	40
PID 4900 wrote to memory of 3036	4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	40
PID 4900 wrote to memory of 3036	4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	40
PID 4900 wrote to memory of 3036	4900	18c92d1d5ac6be054ea8cef9335a9d31c8a3d2cf18db3cc88ef964d590811afe.exe	40

memory/3036-137-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4900-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4900-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4900-136-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4900-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4900-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download