a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93

Analysis

max time kernel
91s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:18

Target

a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
Size

239KB
MD5

cd326121f9d16574b2591b614048397a
SHA1

2dedad92b8323ad1d16ea4fb23220bb096e86b1d
SHA256

a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93
SHA512

68ad34d07afb9f6a1a65e15b833961fb731b3d58da2797b432df5a99356ec45d71b8b2c27368cf3fc516a20bc5c28efb02f38740fc0b14ce516727987c1c84f8
SSDEEP

6144:dsdBntcEjjoAmqVnVW5GJZ2tNYLj8MfsTqZabj1RUyswe:OpCpq9VzYKj86sTvUf

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe
720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 532 wrote to memory of 720	532	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	79
PID 720 wrote to memory of 3044	720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	48
PID 720 wrote to memory of 3044	720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	48
PID 720 wrote to memory of 3044	720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	48
PID 720 wrote to memory of 3044	720	a7a4c1a776ac91a59c3570c6b87158ad4113e98f830ad0bd6ddce25aefe84b93.exe	48

memory/532-132-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/532-138-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/720-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/720-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/720-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/720-142-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3044-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download