6fbd2934f653f5085f7ae0b974f11673494f076770e28f6e9b7e1867d783a06b

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:49

Target

35afcf29afedbc371e446aaed65de901.exe
Size

182KB
MD5

35afcf29afedbc371e446aaed65de901
SHA1

54493d831985f569947e43cfc0bf952969860eb2
SHA256

6fbd2934f653f5085f7ae0b974f11673494f076770e28f6e9b7e1867d783a06b
SHA512

57d67f8f4aebe5a5178d5ae2e9318cb05f1c2d3c97b04c3a63b5ddac80f51228cf88991371cd94e1832d30aea684f2ac07bb11b5f88ce8da7645cb321dc6d648
SSDEEP

3072:3HMAmgoqaNU1LiOyzb0qkVoDiYE2/+S5io/Hw3a5YHG3Pzrc77OWw8x8cj:3HbaNQG4qkVoDiB22B2Hw3alXc769/cj

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3836 set thread context of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 set thread context of 0	3836	35afcf29afedbc371e446aaed65de901.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	35afcf29afedbc371e446aaed65de901.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	35afcf29afedbc371e446aaed65de901.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3836	35afcf29afedbc371e446aaed65de901.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 1408	3836	35afcf29afedbc371e446aaed65de901.exe	88
PID 3836 wrote to memory of 0	3836	35afcf29afedbc371e446aaed65de901.exe
PID 3836 wrote to memory of 0	3836	35afcf29afedbc371e446aaed65de901.exe
PID 3836 wrote to memory of 0	3836	35afcf29afedbc371e446aaed65de901.exe
PID 3836 wrote to memory of 0	3836	35afcf29afedbc371e446aaed65de901.exe
PID 1408 wrote to memory of 3328	1408	35afcf29afedbc371e446aaed65de901.exe	48
PID 1408 wrote to memory of 3328	1408	35afcf29afedbc371e446aaed65de901.exe	48
PID 1408 wrote to memory of 3328	1408	35afcf29afedbc371e446aaed65de901.exe	48
PID 1408 wrote to memory of 3328	1408	35afcf29afedbc371e446aaed65de901.exe	48

memory/1408-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1408-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1408-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1408-9-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1408-16-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3328-10-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3328-11-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3836-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3836-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3836-8-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download