67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:27

Target

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
Size

54KB
MD5

e623fa41d5df762ef3fb185b92a4ee36
SHA1

72d63c4eb50370765c776f1dd86100accff9058c
SHA256

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286
SHA512

c5ee27d5756a88c130427e3a0d0440e6eafd9c52a69fc29de054e5b5600a6a0bba5b76daa06e075d55369f2f16199131d739db86ed7bf3b677a5858aa61b75b6
SSDEEP

768:VCQXtb3VdFbaeNsovJ1fgg/jTVa4MT87G9kVTiiYZe6Dm9Wb7rT364c0L1hF:VxV5sU1f3T9niiIe6D4Wn64JLLF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

description	pid	process	target process
PID 5004 set thread context of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

pid	process
764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe

description	pid	process	target process
PID 5004 wrote to memory of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 5004 wrote to memory of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 5004 wrote to memory of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 5004 wrote to memory of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 5004 wrote to memory of 764	5004	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe
PID 764 wrote to memory of 760	764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 764 wrote to memory of 760	764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 764 wrote to memory of 760	764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE
PID 764 wrote to memory of 760	764	67e16f32a0cf9fa25fd4608a12e1e44c364cf3becbfdbec60e2f957944836286.exe	Explorer.EXE

memory/760-137-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/764-132-0x0000000000000000-mapping.dmp

Download
memory/764-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-136-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/764-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/764-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download