d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:58

Target

d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe
Size

180KB
MD5

2a2eba006d7b6560da64f8f63eb616af
SHA1

9fb832cfb2deccccea70f6badd8719973cedf136
SHA256

d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f
SHA512

83a3e56b0b2d995bfcfe62b381bb1f5eec6d6c9d3ecb8a50c2ff67919da808c5f5547722c9ef4ce0d26f713ffb2bc3338c1b0bae272e05fad2eab1f4ef493080
SSDEEP

3072:YW2QGgdWWmJLluZIwfvXhX4nNQNGSz0ABNxZZfnK5D/JNuWtrqAgRX41kbQY/L9z:Y1FD0hInNaV7xZZfnKdJN/trq14vY/LJ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe
1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe
1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe
1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1028 wrote to memory of 1128	1028	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	79
PID 1128 wrote to memory of 2152	1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	72
PID 1128 wrote to memory of 2152	1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	72
PID 1128 wrote to memory of 2152	1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	72
PID 1128 wrote to memory of 2152	1128	d80c96da7ec76a2330e7674dd4a1b17b811fad4a1b576395240f1e63ee388d9f.exe	72

memory/1028-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1028-138-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1028-139-0x00000000005B0000-0x00000000005B4000-memory.dmp

Filesize
16KB

Download
memory/1028-140-0x0000000000610000-0x0000000000649000-memory.dmp

Filesize
228KB

Download
memory/1128-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1128-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1128-143-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2152-142-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download