b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3

Analysis

max time kernel
155s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 21:24

Target

b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe
Size

83KB
MD5

dcd2ab45f24ebc0f514230b16dd0b2ef
SHA1

4b989025bd0bcb12b34cfd707c1efd5577c16dde
SHA256

b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3
SHA512

f01cf7802c2a03e9babc1f41ef41f535951a71da186fe09c624b38c6f22206a0c0e539daa837fa53dcc4b1833513572e0fb46eda47eab8417ccd01e966669396
SSDEEP

1536:7zVODkILLz4qYIkKArpZLQWeHrpc8rDMTe:gDBL36IkDR4rpzrQa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe
400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe
400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe
400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 4052 wrote to memory of 400	4052	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	85
PID 400 wrote to memory of 3020	400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	49
PID 400 wrote to memory of 3020	400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	49
PID 400 wrote to memory of 3020	400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	49
PID 400 wrote to memory of 3020	400	b65159ee49ce96322d45e28eef189e7289b10b5eef08127268449f33aeffcaf3.exe	49

memory/400-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/400-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/400-140-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/400-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3020-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4052-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4052-138-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download