9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 10:54

Target

9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
Size

195KB
MD5

c566ab910ed4f09a9fb2d28c4ba54f8b
SHA1

f17b6cb02aa24f31c6787c756bf610b1877cf477
SHA256

9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf
SHA512

f8a953ea9975c2d56ffc432c61a0ec286f18fd072a9b489a1f8a1cb9c7e62a01ad8e973e415634976958f72712003f31355424ff3ddec6648105f73df1be4e52
SSDEEP

1536:bDwgP6hjJqantG4kjxgWGHk/KtKwNPkUGNAT7adRVNSDl29uLBCnnR4an:b56hFqHNKtKW5WATudRVNSIiCian

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe
4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4984 wrote to memory of 4872	4984	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	81
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53
PID 4872 wrote to memory of 2640	4872	9ec0fe41c443751d0cf159f1480c2f19be7365169fef3f21f8c7cde44b04d8bf.exe	53

memory/2640-138-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4872-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4872-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4872-137-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/4872-139-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download