dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:08

Target

dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
Size

409KB
MD5

3cfff208757cbe2327d3b6453706ca2c
SHA1

6a3d504cac2124ba629d4a9dff7eaaa755c98737
SHA256

dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428
SHA512

1f8643567f121905a26c8ac4b1bdb9fdc1d6b216bcf5412d59c5861d16e94f1fdb11999b057307666966abba2f9202935c56d02af8c084691c7d6eab1213c189
SSDEEP

6144:BlJ9PmJ0aNgn8LEb+XdBP4OhLBxA1s8+wqsnHUf8E53e+SLl62:TjPm2eo/EPlhtGW83tHUF53e+0f

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4972 wrote to memory of 4888	4972	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	82
PID 4888 wrote to memory of 2664	4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	52
PID 4888 wrote to memory of 2664	4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	52
PID 4888 wrote to memory of 2664	4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	52
PID 4888 wrote to memory of 2664	4888	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	52

memory/2664-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4888-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4888-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4888-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4888-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download