fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15

Analysis

max time kernel
192s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:00

Target
fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe
Size 92KB
Sample221127-ra4mkace36
SHA256 fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15
MD5 af6b7a625180212b77f38fc7550dee40
SHA1 f3ec6978a4c3f9183c66550a612929f97068bba5
SHA512 c9f8fd8c6652dea63b14f336eeffc2b5c888f43e7ab9d8fd336a2f5d549f264f1f9b6f81d0e6c2a83031311c5ef178bb6648e7b6e461c9c117966147a35a1b83
SSDEEP 1536:pLTjavDj/fNRep5Y5pBpPdEBKfMsjRl7uucRrp:pM5RepK5pBK+Cb
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	winver.exe
3560	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3560	winver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 5016 wrote to memory of 3812	5016	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	84
PID 3812 wrote to memory of 3560	3812	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	85
PID 3812 wrote to memory of 3560	3812	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	85
PID 3812 wrote to memory of 3560	3812	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	85
PID 3812 wrote to memory of 3560	3812	fbd6a8358c28cb298ddb28564de34c6d3f705726030f558950cd643d5e442b15.exe	85
PID 3560 wrote to memory of 2620	3560	winver.exe	18
PID 3560 wrote to memory of 2608	3560	winver.exe	23

memory/2620-139-0x0000000001210000-0x0000000001216000-memory.dmp

Download

memory/3560-138-0x0000000000720000-0x0000000000726000-memory.dmp

Download

memory/3812-135-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3812-137-0x0000000000700000-0x0000000001100000-memory.dmp

Download