94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8

Analysis

max time kernel
83s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:59

Target

94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe
Size

574KB
MD5

8790f5437179bd123cc0582b8b4aad27
SHA1

213830d693786abef0f3d9169305d79e95263974
SHA256

94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8
SHA512

37930f601d95b93a875ee34f6595cfc4646fc16db6a6bbf7625b7ddfc5b06bf2e3f124e22ec3cc967503e444ac049a4dbd146d106b4ff791ccea91666391f86f
SSDEEP

12288:Peu9N7fn5nPmm1zYXj/+D7xn36eqXFOz/U89L08gU:GcRn5PmoYaBRQy/h9g8z

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3248 set thread context of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 3248 wrote to memory of 804	3248	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	82
PID 804 wrote to memory of 2440	804	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	41
PID 804 wrote to memory of 2440	804	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	41
PID 804 wrote to memory of 2440	804	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	41
PID 804 wrote to memory of 2440	804	94539d4c2e81d1133ebd77311f8e57248c48e2cdb19d42153a81486af28c63d8.exe	41

memory/804-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/804-142-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/804-144-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2440-143-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3248-132-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3248-135-0x0000000000970000-0x00000000009BE000-memory.dmp

Filesize
312KB

Download
memory/3248-136-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3248-140-0x0000000000970000-0x00000000009BE000-memory.dmp

Filesize
312KB

Download
memory/3248-141-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download