f13cf796d7c60ef92882baddbefd79e9ca9784c76423e415b585af5627ae2bec

Analysis

max time kernel
143s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:43

Target

1a68373abb433f833ecac1feb086dc14.exe
Size

71KB
MD5

1a68373abb433f833ecac1feb086dc14
SHA1

e7320210fe13a5a0d7ad099ba7a71bdbc6fc50b5
SHA256

f13cf796d7c60ef92882baddbefd79e9ca9784c76423e415b585af5627ae2bec
SHA512

dd34a8310a9741a59ab1ad2b396c74c1d53da557a3b7a10488a46483344ae0683672f9dddd0f6d7e27b313ae5686d7ce15ce52e1874d2fd2b4d35316eecf62ce
SSDEEP

1536:uR5U2dUbcCNET1KXNKcAWFgVeyciaaA00TKsm+:uR5U2dUgCNlQsiaZF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	1a68373abb433f833ecac1feb086dc14.exe
3396	1a68373abb433f833ecac1feb086dc14.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3244	1a68373abb433f833ecac1feb086dc14.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26
PID 3244 wrote to memory of 3396	3244	1a68373abb433f833ecac1feb086dc14.exe	26

C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
"C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
  C:\Users\Admin\AppData\Local\Temp\1a68373abb433f833ecac1feb086dc14.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396

memory/3396-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-14-0x0000000000400000-0x000000000040F7AC-memory.dmp

Filesize
61KB

Download
memory/3396-13-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3396-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download