56dd3213eb13e5e521b3b04ad35af9d6e5579ce0253a76d177453e9cecac50f7

Analysis

max time kernel
135s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:54

Target

RunPE.exe
Size

7.7MB
MD5

73ae44f680eb1f5b56e5e531e3e2d590
SHA1

085667af1324840e3b21cb2af7e4e6370a11658c
SHA256

6d3b06055202cf07167fdc7ed70ec20f0616ccb00cfa2ac4ff6b1c14dabaced0
SHA512

ac2ee303aee5cdcdb965b4a3efe8de5e4117e71676f29bf50ab469287634988778ec922a4f6da5561c66eb5ad99e7fc1ba4a31b97722ef9bcb711c27cb729878
SSDEEP

196608:99CqzRjh0/9+3LRiQbpQ3lnS6nbVkR7CQfqT2jJMWHOk:99TzR1Y+3LRiQbpQ2t7VMjk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

RunPE.exe

description pid process target process

PID 3800 set thread context of 812 3800 RunPE.exe RunPE.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RunPE.exe

pid process

3800 RunPE.exe

description	pid	process	target process
PID 3800 set thread context of 812	3800	RunPE.exe	RunPE.exe

pid	process
3800	RunPE.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

RunPE.exe

description	pid	process	target process
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe
PID 3800 wrote to memory of 812	3800	RunPE.exe	RunPE.exe

C:\Users\Admin\AppData\Local\Temp\RunPE.exe
C:\Users\Admin\AppData\Local\Temp\RunPE.exe
2⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
1⤵
PID:3308

memory/812-3-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download
memory/812-2-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download
memory/812-5-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download
memory/812-6-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download
memory/812-7-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download
memory/812-4-0x0000000000400000-0x0000000000BEE000-memory.dmp

Filesize
7.9MB

Download