e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d

Analysis

max time kernel
220s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:12

Target

e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe
Size

171KB
MD5

b1444513ebe1b74a969c009c6f875085
SHA1

97d7d05bec18a860926a2aa69f168cd721f1af30
SHA256

e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d
SHA512

bd034761ef8a2bbcb0a1cddffef6515bf09f233f8697266db4f35a40ebfcbe3a242132d582fe5fe06986c688d1e9bccb6c8dff678942bbb7550d27f9fe620d63
SSDEEP

3072:FlOaECL+CnYdHn7eplJocDsZDfCnk8AsPYMGbQvCINdncp2oxuEKbzkyOmLZe42r:FE/Cq3Qoc4ZfCk1swMGbI1doxTSTOmEB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3316 set thread context of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe
1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe
1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe
1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 3316 wrote to memory of 1396	3316	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	80
PID 1396 wrote to memory of 3092	1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	54
PID 1396 wrote to memory of 3092	1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	54
PID 1396 wrote to memory of 3092	1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	54
PID 1396 wrote to memory of 3092	1396	e99b1c5cae5ae4f0e007b0385a3fcb1cf15d88fc922df8089fe8a365c77c698d.exe	54

memory/1396-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-140-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3092-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3316-134-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3316-138-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download