a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 03:59

Target

a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe
Size

69KB
MD5

d8ff54c058c80f42c262124e0ad582a9
SHA1

186c44abfeac9dbc7131ee6294168634b59c7a8d
SHA256

a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b
SHA512

8e4ad620b4e26f8955a03b0751b378b1b966359c63f0cdc9380dfff0587f0275584248242600fa3a5e5faae1ea41e88a2b792291cfc539e7de9c10a1e3a3a8b2
SSDEEP

1536:OYEiFMLao04I0QoWQII3dRlObu8x7Q5I/R:XEiFvo04jQuP3ROK8xQ5Ip

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3448	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3448	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe
3448	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 4264 wrote to memory of 3448	4264	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	80
PID 3448 wrote to memory of 3768	3448	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	81
PID 3448 wrote to memory of 3768	3448	a52b3d6de13c19bc415282ea6084984720bf453a7b7347185f49e66946ddff4b.exe	81

memory/3448-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3448-136-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3448-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3448-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4264-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4264-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download