9e4ea8ec8b01400bf65120de422df7a1bf3405eb9c526567302f5df9a0105b7e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 15:58

Target

hiao0k.exe
Size

197KB
MD5

33aee0a29e6e755390997b138a7bc3f8
SHA1

3771201083f9fc6aef130b2edccb8c7d1633ed56
SHA256

9e4ea8ec8b01400bf65120de422df7a1bf3405eb9c526567302f5df9a0105b7e
SHA512

3093d4c89497f1ed65785b1adbd2f2bfc467083349731f83363c4cee1f0c3348c0b8f2f8b09ce56ce97b0be460bc8da47f4e0b9e30a4030d9e578078e6464d69
SSDEEP

3072:EstQZLgXcdBJ4OxWm1M/j0vBP6xlL+KJC23IasjoqEuPf0sJjCXrUKbHmbU:/QdEcdoozvt85C23IassqesJeBGw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3096 set thread context of 636	3096	hiao0k.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	hiao0k.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4456	3096	hiao0k.exe	88
PID 3096 wrote to memory of 4456	3096	hiao0k.exe	88
PID 3096 wrote to memory of 4456	3096	hiao0k.exe	88
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 3096 wrote to memory of 636	3096	hiao0k.exe	89
PID 636 wrote to memory of 3504	636	hiao0k.exe	57
PID 636 wrote to memory of 3504	636	hiao0k.exe	57
PID 636 wrote to memory of 3504	636	hiao0k.exe	57
PID 636 wrote to memory of 3504	636	hiao0k.exe	57

memory/636-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/636-20-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/636-19-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/636-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/636-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/636-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/636-6-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3096-3-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download
memory/3096-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3096-11-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download
memory/3096-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3096-4-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/3096-2-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download
memory/3096-1-0x0000000000580000-0x0000000000582000-memory.dmp

Filesize
8KB

Download
memory/3504-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3504-15-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download