8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2

Analysis

max time kernel
147s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:30

Target

8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe
Size

82KB
MD5

90b94c88b708cddc8b956ccbb5a576c4
SHA1

4a6ff932616dab37112f74851e70269372a5a4f5
SHA256

8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2
SHA512

868407714e3e9cfb5dc6e2b0bcb1072b969a58304b153c75af164989866b3406a52dde4d67885aafd9747d92b00436dbe8e084a55a66774ccac10e7051147b3e
SSDEEP

768:+xF4OzBImMow7n7zMrjkX78YTqM7Mys8c4YVtpVoWb4mr9/lqy1gLa1Vf:xCMz7QrwXjTqLya4YnvLblr9/luLaL

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1868	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1868	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe
1868	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1312 wrote to memory of 1868	1312	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	82
PID 1868 wrote to memory of 4068	1868	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	84
PID 1868 wrote to memory of 4068	1868	8595064db1b871c99a35926a1861a8262b31e71da5d5251334103ab7739d56e2.exe	84

memory/1312-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1312-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1868-133-0x0000000000000000-mapping.dmp

Download
memory/1868-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1868-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1868-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1868-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1868-141-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4068-140-0x0000000000000000-mapping.dmp

Download