e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87

Analysis

max time kernel
160s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:53

Target

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
Size

88KB
MD5

98770dc6e752c90d0e3bcbfd520f9edb
SHA1

e800be021fe392e3b6eaaca8a8e7da3f2715818b
SHA256

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87
SHA512

792d9c9d52a1acc7fab9c2f639ab67c49854e183c2ea25b28f46500b73a5f0e3eff380966533e84205b774130bb7802c6a00fc3ad487c897dab2ea821994e32e
SSDEEP

768:ENnCefOr6z+fxahPoQ+e5YS50Ni1RErCZa+0AC4bQmbVpgONRk/HfgoNNAxr:EnXfOYGxbFe5H50GRxCMQmwFRK

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

description	pid	process	target process
PID 3248 set thread context of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

pid	process
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

pid	process
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

description	pid	process	target process
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
PID 3248 wrote to memory of 1248	3248	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe	e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe

C:\Users\Admin\AppData\Local\Temp\e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
C:\Users\Admin\AppData\Local\Temp\e9b4e4ffb3943a08bc1c7b7bc7548aa5ce6e53375514081caf8d8973eadf5c87.exe
2⤵
PID:1248

memory/1248-132-0x0000000000000000-mapping.dmp

Download
memory/1248-133-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1248-136-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3248-134-0x0000000000AA0000-0x0000000000AA4000-memory.dmp

Filesize
16KB

Download