a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 22:09

Target

a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe
Size

77KB
MD5

d70665734296658d54d8af8a494b29f4
SHA1

ea865f518d0cddb4bd053e1f7141084034d719a4
SHA256

a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0
SHA512

f6a4fae33e56f3b081706139c3c54ae4ab2d5deb55ac9a6d3ec8f993a6e45caf27fd38929cbc2bd603642574665bcdeb4dd75da54d451415f44eb2e8746b9c80
SSDEEP

1536:R61BsWcCXUDp0tUAbBUfP0gdtppT0bZuuI4ZHjrqKbVe5R:SJ5Yp0tU2g0gLppTwH6Kpo

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 456 set thread context of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 456 wrote to memory of 212	456	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	96
PID 212 wrote to memory of 3156	212	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	57
PID 212 wrote to memory of 3156	212	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	57
PID 212 wrote to memory of 3156	212	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	57
PID 212 wrote to memory of 3156	212	a1b29a132898669c9d244ebf67e63f9bb34f6184cf34921c165c60cb48174bf0.exe	57

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4024

memory/212-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/212-4-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/212-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/212-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/212-9-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/212-16-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/212-17-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/456-0-0x0000000000400000-0x0000000000407001-memory.dmp

Filesize
28KB

Download
memory/456-8-0x0000000000400000-0x0000000000407001-memory.dmp

Filesize
28KB

Download
memory/3156-11-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3156-12-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download