f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952

Analysis

max time kernel
33s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 16:07

Target
f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe
Size 84KB
Sample221127-tk3t5aae84
SHA256 f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952
MD5 ad08725b07e785fda98be9b672c3142f
SHA1 e20382e68a14754cff479be1b0bdd218479bce44
SHA512 8a7d37b6f5ef2f9ce6aff319d3267d2ecc6990b1f4b2ab0b1dbab0d82711bc186ede310334bf122da386ab508e6226de0d93f4e566c0d61d347f1ec42fa6e6e8
SSDEEP 768:NL2nV/xf1YW47yg8AsO4KZEMEl1Vpil/MsK3LQCsV5OKuulwUPcbvCBdKejQg:NLQ91YXOJljcqs5CY4KLlw/bXeN
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
232	winver.exe
232	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
232	winver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 3804 wrote to memory of 1528	3804	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	82
PID 1528 wrote to memory of 232	1528	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	84
PID 1528 wrote to memory of 232	1528	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	84
PID 1528 wrote to memory of 232	1528	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	84
PID 1528 wrote to memory of 232	1528	f18f5d25ad4f674066fb32d33db9e68138514e1c48cb9ad627ef8da5a3d80952.exe	84
PID 232 wrote to memory of 1068	232	winver.exe	64
PID 232 wrote to memory of 2528	232	winver.exe	72
PID 232 wrote to memory of 2580	232	winver.exe	70
PID 232 wrote to memory of 2808	232	winver.exe	65
PID 232 wrote to memory of 1068	232	winver.exe	64

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

memory/232-138-0x0000000002330000-0x0000000002337000-memory.dmp

Download

memory/1068-139-0x00000000007B0000-0x00000000007B7000-memory.dmp

Download

memory/1528-135-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1528-137-0x00000000006F0000-0x00000000010F0000-memory.dmp

Download