571fdba3497a39c7a202753e671f5002323a302d895a8d1862419622953e1c6a

Analysis

max time kernel
130s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:06

Target

雷霆之怒夜涩辅助V2.3/edison.exe
Size

3.8MB
MD5

518f36099e6526c41e44ccfdf2665a99
SHA1

acb3288e67fd5381ef6d89ba6031a623c535c481
SHA256

e14eaf02998acd6c3ae092c1f6a62377e64add5ed410096df693388694cb19c4
SHA512

e1977eff04ea4fcfc19a119f37cf165b945662cf858e2cb918ec9f8716e354657c545ac2fc8f3e96a239978589d1ff88e6571db47020d7ca8e4d127618bcf478
SSDEEP

98304:hUlRr8eWMeymfqEbW5UAGAD2jMjtDTu+jrrc+:hO81Me6SrAMMZfu2H

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs

Processes:

edison.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

edison.exe

pid process

4340 edison.exe
4340 edison.exe
4340 edison.exe
4340 edison.exe
4340 edison.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

edison.exe

description	pid	process	target process
PID 4340 wrote to memory of 2560	4340	edison.exe	edison.exe
PID 4340 wrote to memory of 2560	4340	edison.exe	edison.exe
PID 4340 wrote to memory of 2560	4340	edison.exe	edison.exe

C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe
"C:\Users\Admin\AppData\Local\Temp\雷霆之怒夜涩辅助V2.3\edison.exe"
2⤵
PID:2560

memory/2560-1260-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1259-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-134-0x0000000075690000-0x00000000758A5000-memory.dmp

Filesize
2.1MB

Download
memory/4340-136-0x0000000076F80000-0x0000000077120000-memory.dmp

Filesize
1.6MB

Download
memory/4340-137-0x0000000076120000-0x000000007619A000-memory.dmp

Filesize
488KB

Download
memory/4340-133-0x0000000077130000-0x00000000772D3000-memory.dmp

Filesize
1.6MB

Download
memory/4340-132-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1261-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1262-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1263-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1265-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1266-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1267-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download
memory/4340-1268-0x0000000000400000-0x000000000091F000-memory.dmp

Filesize
5.1MB

Download