5dcc0631b89dc4c6265a07489f0adeab2a534caae2e24981f2de7f77d55ac91d

Analysis

max time kernel
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 04:32

Target

rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
Size

172KB
MD5

b3746da8e9565cdc99309bb7ab4981cb
SHA1

eef70319961f720e69e6814e8b0ec30860617e47
SHA256

318da5393b33eecd56b85758d52f3baf0a01e19c979c910099e61da6b86099b0
SHA512

1b8c90c6ec5c2ef523522acb6cd04f9c618e3cf2a072d982caac191c1f78f862e54637365da324b3917903c9104fda5af0e68f6fcd1043d439abee9c419263e6
SSDEEP

3072:LRSCwISjY+sxh2IMI4637xoSGYkMPVOgiaN1Tbll2uyjn:LRmLjY+szrLkMPVOza7TS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 4764 wrote to memory of 3956	4764	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	80
PID 3956 wrote to memory of 3052	3956	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	81
PID 3956 wrote to memory of 3052	3956	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	81
PID 3956 wrote to memory of 3052	3956	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	81

memory/3956-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3956-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4764-132-0x00000000014B0000-0x00000000014B4000-memory.dmp

Filesize
16KB

Download