b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd

Analysis

max time kernel
147s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 19:04

Target

b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe
Size

101KB
MD5

c6b1c1d86809801a3f8003538861d5b4
SHA1

9b518f14587b3a1489d57b761ad5af7200567310
SHA256

b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd
SHA512

22ab21722e076c66999f5896bdefac78606e8928132e6b595565747eb9595b65fce8f1597e64c1c5b3cf8f08c509a8b6e5ba1106fbb9c33346add6e54cee4e62
SSDEEP

1536:cDti6KZiKx8La8wenOadt+xButh6GEbDNZRAfC0TOA:cDti6GisPQO1bwEbXRMCA

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 208 set thread context of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe
3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 208 wrote to memory of 3860	208	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	82
PID 3860 wrote to memory of 4256	3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	83
PID 3860 wrote to memory of 4256	3860	b589714421a06f4639c5abbf7be3fcb1d1251bd82e669c9a252b9a7bbe3ad8fd.exe	83

memory/208-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/208-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3860-136-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3860-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3860-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3860-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download