a992eae75383e3f1aee610326c9f2846bdbfbfb6f5c6af6f25af222b258d871e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 02:21

Target

Server_al-swisre.exe
Size

284KB
MD5

dd431b788e4286f3466ad3ce2bb6aadd
SHA1

b688bad0bac40ce97a7d62128a0165ca74e907dc
SHA256

da03de3c73d6d5c0802b1c883a5172844c7f916304b14ad2133e8f55b987c264
SHA512

de804b56e4ffaa4a758f59583fed19c6ee43cb0a7482fe5f74f5d535bc3afe46ca1fa805cc08a1beb3138a9a3c396991f22dba355c6bd55b3301c27bc8d03513
SSDEEP

3072:h6Lca+56U04mw49Y3r1suFiEIN1suFiEIAO1m1TPy:tzFByzFBK1m1O

Score

5^/10

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 3964	1936	Server_al-swisre.exe	87
PID 1936 set thread context of 3492	1936	Server_al-swisre.exe	88
PID 1936 set thread context of 0	1936	Server_al-swisre.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1936	Server_al-swisre.exe
3964	Server_al-swisre.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3964	1936	Server_al-swisre.exe	87
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 3492	1936	Server_al-swisre.exe	88
PID 1936 wrote to memory of 0	1936	Server_al-swisre.exe
PID 1936 wrote to memory of 0	1936	Server_al-swisre.exe
PID 1936 wrote to memory of 0	1936	Server_al-swisre.exe
PID 1936 wrote to memory of 0	1936	Server_al-swisre.exe
PID 3492 wrote to memory of 3412	3492	Server_al-swisre.exe	56
PID 3492 wrote to memory of 3412	3492	Server_al-swisre.exe	56
PID 3492 wrote to memory of 3412	3492	Server_al-swisre.exe	56
PID 3492 wrote to memory of 3412	3492	Server_al-swisre.exe	56

memory/3412-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3412-15-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3492-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3492-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3492-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3492-13-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3492-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3964-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3964-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3964-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download