86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 17:32

Target

86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
Size

181KB
MD5

e00cbc650df1f619fa7f4eafafd6f834
SHA1

c3063a6b475e1a7438ed35b3c5263bb27b75ed01
SHA256

86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780
SHA512

8104f2d9b883bd2946ae098515b99de9299e8fecb5b4b1438142bc4fbf17f2b7a3945230e0d2c44d732144e180ed93e64d58e84a915a688892e519829b12c1e4
SSDEEP

3072:5RBUFBNGJZuY4ttUIh8YasiYHqYJGBWzcJvHJ1S/JmmO:5nuUZF4tSI+YdzjJGBC4vnSxm7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79
PID 4772 wrote to memory of 876	4772	86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe	79

C:\Users\Admin\AppData\Local\Temp\86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
"C:\Users\Admin\AppData\Local\Temp\86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
  C:\Users\Admin\AppData\Local\Temp\86038bf1e8c9b592f28bd94cc0bd63b56f304b686ea9bb22d8cb6b55b6c1d780.exe
  2⤵
  PID:876

memory/876-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/876-139-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4772-132-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4772-138-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download