c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb

Analysis

max time kernel
154s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 17:25

Target

c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe
Size

70KB
MD5

c4a9f7e33dd27e911365676dc41fa23e
SHA1

aea8404c622e3e25cad7757d9f0bd9ed5c5d9575
SHA256

c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb
SHA512

64607b0d1af783d335ac462f85040de99340aacc0429800d642dba7c7046049c4b5c88b3505ddc60672eda17c178a0fd57dc19be0a10dbfcb33119043697da76
SSDEEP

1536:ItdjgaKvSFr/2DgcgifMPvITVm20+74xEPBE3cV:sWDvSFr/2DHxMP2m2JE2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4952 wrote to memory of 4392	4952	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	79
PID 4392 wrote to memory of 2492	4392	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	42
PID 4392 wrote to memory of 2492	4392	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	42
PID 4392 wrote to memory of 2492	4392	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	42
PID 4392 wrote to memory of 2492	4392	c35b5ba322b86a3c5c99043736390b529edc396467d08fa0f2ae6117658b23fb.exe	42

memory/2492-136-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4392-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4392-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4392-137-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4392-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download