eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1

Analysis

max time kernel
176s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:40

Target

eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
Size

123KB
MD5

7dbbe0d2150a671d7f65b4c387d68773
SHA1

5329662abbeef51f47e9283c704a9dae1e0fcb61
SHA256

eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1
SHA512

e20d6eab7ecc36cbfc42d1c86caf533b2bdca649f453fc85f7773cae33d4aa6a53c266261a584ae7889084bf0623898bb058fb6bda483e3d56a17870a12e1c3f
SSDEEP

3072:XLF9CWADbxOhoFQ8G6felNwb4mj32OVuGEU8iW+:7F9CR1OhoC83b2kuBqD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4320 set thread context of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82
PID 4320 wrote to memory of 1692	4320	eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe	82

C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
"C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
  C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
  2⤵
  PID:1692

memory/1692-133-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/1692-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1692-137-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/1692-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1692-138-0x0000000000400000-0x0000000005DD8000-memory.dmp

Filesize
89.8MB

Download
memory/1692-140-0x0000000000020000-0x0000000000027000-memory.dmp

Filesize
28KB

Download
memory/1692-143-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4320-134-0x0000000002330000-0x0000000002334000-memory.dmp

Filesize
16KB

Download