e8a3ef1c9366a7a0ba1138557b3c39eaeac552c06bf55d0724a02e36467838c5

Analysis

max time kernel
4s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 04:48

Target

volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
Size

148KB
MD5

85361cc6dd212579eb0c5974a7ab0faf
SHA1

8a9d5e8cd1f75b48b4113955b55849bc10a9eb14
SHA256

b673c683d1ae36a0c6401adda9d23e05468fe2a5067ad4d785b39c0aed4f125e
SHA512

593af436b85f2a2540b143c79a93211e499bec7de583cbdfa46fd5f432fa52c1f0ed99dc18e6eb654622bedeb1a0b3decb77b3ad09f46bc9c687117dec0dae3a
SSDEEP

1536:+fr+0Z9MV6eBqDDo2d7M6RO5UrU5mOLiWJ1L6RtJvfyGYkk/8H8LnSH0yxWuf:VYLeS08nc5UrUPLiWJKJf548HkSUyMuf

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 2320 wrote to memory of 1780	2320	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	81
PID 1780 wrote to memory of 4388	1780	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	82
PID 1780 wrote to memory of 4388	1780	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	82
PID 1780 wrote to memory of 4388	1780	volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe	82

memory/1780-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1780-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1780-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2320-136-0x0000000000C40000-0x0000000000C44000-memory.dmp

Filesize
16KB

Download
memory/2932-139-0x00007FF81AE90000-0x00007FF81AEA0000-memory.dmp

Filesize
64KB

Download