8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:09

Target

8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe
Size

60KB
MD5

315e8fabbdd7ae9668ce6b30d51f2887
SHA1

1dadd3d079975f4a8bf7d082ffbdd7afd35e1591
SHA256

8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781
SHA512

7714f804aa2718d0548b5aa8f206ac46b6f4c34c2cbf1d63539e511eb14dd1c5aba04cace0f1b5183ba6b30fbeace99573e1365f524055c5bf51247a59013bed
SSDEEP

1536:uVBWEnsbRmk3aQcQ1v8OjFS4ZouXSgWTd0:uvWYsJaQcQ1v8OjsqoA1b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 5072 wrote to memory of 4980	5072	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	83
PID 4980 wrote to memory of 760	4980	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	16
PID 4980 wrote to memory of 760	4980	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	16
PID 4980 wrote to memory of 760	4980	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	16
PID 4980 wrote to memory of 760	4980	8c1603295770aecae67591c750866b3088388a19a26532b7e6a0fbf26d80f781.exe	16

memory/760-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4980-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4980-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4980-141-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4980-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5072-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5072-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download