e44a39a023ef3df82f180c98c0479bc3e67b44a2a19656516386a420bdafa1bb

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 09:49

Target

152c739f87218024ba97b487ca229213.exe
Size

352KB
MD5

152c739f87218024ba97b487ca229213
SHA1

6dfd58d00a18385d12c798ba87d46a1194cbd969
SHA256

e44a39a023ef3df82f180c98c0479bc3e67b44a2a19656516386a420bdafa1bb
SHA512

0467f6fe9f11231d4df1570a497ed14e9f63a3cdcbab2c3003c356b9f83ed0e77cd858b867f33e785b44cb3738fa5fc4c1bf5473d622dcfd803b605adc4adb2a
SSDEEP

6144:wzYcAIs+zUK76yLY7aQEwhJ98b7w0sbCcVwpDtrYgKC:0s+t47aQEwhJ9479sbjVwpDm0

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3492 set thread context of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 set thread context of 0	3492	152c739f87218024ba97b487ca229213.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	152c739f87218024ba97b487ca229213.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 4056	3492	152c739f87218024ba97b487ca229213.exe	91
PID 3492 wrote to memory of 0	3492	152c739f87218024ba97b487ca229213.exe
PID 3492 wrote to memory of 0	3492	152c739f87218024ba97b487ca229213.exe
PID 3492 wrote to memory of 0	3492	152c739f87218024ba97b487ca229213.exe
PID 3492 wrote to memory of 0	3492	152c739f87218024ba97b487ca229213.exe
PID 4056 wrote to memory of 3472	4056	152c739f87218024ba97b487ca229213.exe	52
PID 4056 wrote to memory of 3472	4056	152c739f87218024ba97b487ca229213.exe	52
PID 4056 wrote to memory of 3472	4056	152c739f87218024ba97b487ca229213.exe	52
PID 4056 wrote to memory of 3472	4056	152c739f87218024ba97b487ca229213.exe	52

memory/3472-7-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3472-8-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4056-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4056-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4056-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4056-6-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4056-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4056-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download