c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:10

Target

c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe
Size

572KB
MD5

48dc159419d5ea7003c2384b0b9d3592
SHA1

98937572d2ad3773b97f2c1bacb992627658a9c9
SHA256

c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610
SHA512

0426602e613499dc87d9d7061fb5a6a9f20376bf83f40dc09bcd495278eecf401a7a29676a59948cc26f926532d5a5745f6d76d9f52545a0fd8c72a7b04f5ab4
SSDEEP

12288:bEN96CreYOOkitndE2CDwmK/lGRgOUqmq9kR6lhKXr6kO+rTTUtXYL6:Sr1OEdEFDwmK/cRgOnmq9g6gLOWgtX66

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4900 set thread context of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe
536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe
536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe
536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 4900 wrote to memory of 536	4900	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	80
PID 536 wrote to memory of 380	536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	34
PID 536 wrote to memory of 380	536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	34
PID 536 wrote to memory of 380	536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	34
PID 536 wrote to memory of 380	536	c50625a2b6a318c57b7c63abdb3f6212eb914aa7e81d929c0de890a1592cf610.exe	34

memory/380-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/536-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/536-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/536-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4900-137-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4900-138-0x00000000021C0000-0x0000000002220000-memory.dmp

Filesize
384KB

Download