efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:12

Target

efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
Size

109KB
MD5

9278081fc31fcc3ed7fe73d3017e356d
SHA1

50c5987b0ba5304d0168f9ca7af5ddf383966b3b
SHA256

efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb
SHA512

076f40ed7a53bcec0df5f9cfaabf3f2a1394ed947835cd0a60c71ee3961aa700bf3d8d6b0272bdc985f62b36eaf38659efcb822e833bb4df5d032fe4ad110a44
SSDEEP

1536:CSVVNlLaF/buyVfsR1W5dou71Qx2aUUQk4oWl:HVNEF/bF9sLW5dou7ex2aUdzow

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3340 set thread context of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 3340 wrote to memory of 4708	3340	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	80
PID 4708 wrote to memory of 4764	4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	81
PID 4708 wrote to memory of 4764	4708	efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe	81

memory/3340-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3340-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4708-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4708-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4708-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4708-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download