4ac002b7e28d95575ea8cdfa906dbb5f9ec0bdef6f35f6393e26af28e30c9a49

Analysis

max time kernel
156s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 05:29

Target

2a08855e615abd31fe1417a503ccce54.exe
Size

69KB
MD5

2a08855e615abd31fe1417a503ccce54
SHA1

a803853135650472021fd416b04e5f5592919afe
SHA256

4ac002b7e28d95575ea8cdfa906dbb5f9ec0bdef6f35f6393e26af28e30c9a49
SHA512

98f98d9e930c610184ef7a2dc6363dc4535bdcbfff4c28ae08146266c3b92a78bcd424e21d1fd37bd9f921f3a0631eea1c56eafd5da0ac5dd15de95b003cfadd
SSDEEP

1536:aXRBF7YskzjXY/Wt+Fk0dtKGy58JS7y6jrg0iWfEM0:0FUsajXYT6GGiS7y6P3R0

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 set thread context of 0	2788	2a08855e615abd31fe1417a503ccce54.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2788	2a08855e615abd31fe1417a503ccce54.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 3752	2788	2a08855e615abd31fe1417a503ccce54.exe	21
PID 2788 wrote to memory of 0	2788	2a08855e615abd31fe1417a503ccce54.exe
PID 2788 wrote to memory of 0	2788	2a08855e615abd31fe1417a503ccce54.exe
PID 2788 wrote to memory of 0	2788	2a08855e615abd31fe1417a503ccce54.exe
PID 2788 wrote to memory of 0	2788	2a08855e615abd31fe1417a503ccce54.exe
PID 3752 wrote to memory of 3492	3752	2a08855e615abd31fe1417a503ccce54.exe	46
PID 3752 wrote to memory of 3492	3752	2a08855e615abd31fe1417a503ccce54.exe	46
PID 3752 wrote to memory of 3492	3752	2a08855e615abd31fe1417a503ccce54.exe	46
PID 3752 wrote to memory of 3492	3752	2a08855e615abd31fe1417a503ccce54.exe	46

memory/2788-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2788-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2788-9-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2788-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3492-12-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3492-13-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3752-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3752-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3752-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3752-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3752-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download