b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd

Analysis

max time kernel
131s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:15

Target

b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe
Size

1.1MB
MD5

e69ccb7b5112483dfea8483bf9987a97
SHA1

b7519a4f2659116beec9144cf6b1848124ee59b2
SHA256

b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd
SHA512

b3fd8188c218adbe18723db22127f721b1072a7418ab8858063c777691ba31ca9d65e09b340a994b51ce9d431a1d899c2f3ea788586cf29f673bcf9cc9e9270b
SSDEEP

12288:x+G9wZ0c/uh4t4BATwmnAk4FhqprU+8Jz+vj6Xk8XcxXWQwZ0ckwt:VGmc/uh4aBvm2et04jUk8XcNW9mckG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe
4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe
4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe
4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4912 wrote to memory of 4192	4912	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	84
PID 4192 wrote to memory of 3020	4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	62
PID 4192 wrote to memory of 3020	4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	62
PID 4192 wrote to memory of 3020	4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	62
PID 4192 wrote to memory of 3020	4192	b4f4578c2e6976b93e1c4343edd1d170600674bf66095d0ece34c8b85bdac2fd.exe	62

memory/3020-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4192-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4192-137-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4192-139-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download