065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:48

Target

065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
Size

651KB
MD5

cc6f7edc4884f2c9f34c9c9e4a17c394
SHA1

042287ef644681e9699acfadc750e51e8d1bb30e
SHA256

065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96
SHA512

b9743d648556c05c4ed1610e6d7cbd0e0db7c7029a3fb537c5f21e3780769d3108c96ef3b5fb92c97202a67dea21b2bafd80012c87b4ea5ce03665a3f0b13976
SSDEEP

12288:4vLDgqO/uCq1eLSh1i7jp0HngrICE2DNMT:4f7O/uCwe2heYwD+

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
4652	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
2100	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4652	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	82
PID 4788 wrote to memory of 4652	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	82
PID 4788 wrote to memory of 4652	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	82
PID 4788 wrote to memory of 2100	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	83
PID 4788 wrote to memory of 2100	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	83
PID 4788 wrote to memory of 2100	4788	065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe	83

C:\Users\Admin\AppData\Local\Temp\065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
"C:\Users\Admin\AppData\Local\Temp\065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\065b155cf392b0b933e2bbfa0597d036eef7c57f7f747e6f3318b69d63e0bb96.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2100

memory/2100-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2100-139-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2100-140-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2100-143-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4652-135-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4652-138-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4652-141-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4652-142-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4788-132-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4788-137-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download