0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 06:08

Target

0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
Size

316KB
MD5

0ff1bb9495a6ce6668d2879ba23a20d0
SHA1

85c483cc72952989577e929cb10e2d1f205928ec
SHA256

0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73
SHA512

097daf72fdd3e58f498a73f68145cc0def6e3a2ea3677af48082614fb906f5490fa48e1f55c70628b274cba7caa83852bb44399b6060426d061e744ee24bb1fa
SSDEEP

6144:d/IAL2nOHUTwzKI5KGaOarJex+qWnFmEk:dS+BzKI5KNNxnFmEk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77
PID 3948 wrote to memory of 1936	3948	0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe	77

C:\Users\Admin\AppData\Local\Temp\0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
"C:\Users\Admin\AppData\Local\Temp\0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
  C:\Users\Admin\AppData\Local\Temp\0d5aaefb056f34e25492dfa1608a5425b11d278c01c0d3d507be33416c3a8e73.exe
  2⤵
  PID:1936

memory/1936-132-0x0000000000000000-mapping.dmp

Download
memory/1936-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1936-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3948-135-0x0000000000640000-0x0000000000644000-memory.dmp

Filesize
16KB

Download