e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd

Analysis

max time kernel
202s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 11:19

Target

e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe
Size

140KB
MD5

5c142d84fa9e48c55190b161aeec4789
SHA1

d5de5026d7098f39d2ce3c6108dd1c795801e437
SHA256

e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd
SHA512

4948321868848ad6f0b678d2b569fecf0d9bdccf545e1ce1786d362e49c33cdc6d52eae7b30becdc676658493c4d8970ddb720ac2d1f3701eca9698cabd7bd1a
SSDEEP

1536:ofHNbP/niUSyNg3REZrFCzZuXgSio/nz5K6TSNSB4N33+2OdZlIZ2tzp:4HNbH0h39uXtr75dTcSi3GdwA9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4956 wrote to memory of 4868	4956	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	78
PID 4868 wrote to memory of 2592	4868	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	54
PID 4868 wrote to memory of 2592	4868	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	54
PID 4868 wrote to memory of 2592	4868	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	54
PID 4868 wrote to memory of 2592	4868	e75d80795687f2f77414918fc093fab5c709209b53e40fc952c22e0235d945dd.exe	54

memory/2592-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4868-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4868-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4868-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4868-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download