c63f8b4b692ea0f8b35f7b755989db3171d0188e2ff756e87b41db17ce1a4be8

Analysis

max time kernel
4s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 02:33

Target

4ce0fe703b4ed966f00bca4b29884f3b.exe
Size

6.4MB
MD5

4ce0fe703b4ed966f00bca4b29884f3b
SHA1

3520c5d5428248ac7282eeaa5a3d1f8ec513064f
SHA256

c63f8b4b692ea0f8b35f7b755989db3171d0188e2ff756e87b41db17ce1a4be8
SHA512

7b9d95495b06c145824a56c8256099d7e635fb172e9fb090382b4ff60dae6a1e36c4762d24f35b5dd6d7d121ace9fe8fefb5ded38cc7a2c4a0ae0f05be37c1ef
SSDEEP

98304:FzeoDRJ/WoD1rHz2/U/nlpsuaZXK6y0igIDi:te0Jvz2/+OHyNgx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	4ce0fe703b4ed966f00bca4b29884f3b.exe
4676	4ce0fe703b4ed966f00bca4b29884f3b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4676	4ce0fe703b4ed966f00bca4b29884f3b.exe
4676	4ce0fe703b4ed966f00bca4b29884f3b.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84
PID 3052 wrote to memory of 4676	3052	4ce0fe703b4ed966f00bca4b29884f3b.exe	84

memory/3052-0-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/3052-6-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/4676-1-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-7-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/4676-5-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-4-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-3-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-8-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-9-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-10-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/4676-12-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download