2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d

Analysis

Target
skazkalzt_crypted.exe
Size 1.2MB
Sample220520-q74hdsaack
SHA256 2dcaabc7567be2d913a8f0df7c972cc19d7ac220889f74342aa40cad5ec80f1d
MD5 a2db5ad04fb9d549f60a829a3293338a
SHA1 2c9cf498fd755b71d46b92bde62f06955d00aa7a
SHA512 36757aa52f416d9af09f06d2e2fc3ad7e78616ec7de81c29aad6391ef5b9bc6e77eebbdcc12e31257550f01b06ba9b502d4c151d5a37e8806192e098048a0719
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1340	2028	skazkalzt_crypted.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28
PID 2028 wrote to memory of 1340	2028	skazkalzt_crypted.exe	28

C:\Users\Admin\AppData\Local\Temp\skazkalzt_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\skazkalzt_crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1340

memory/1340-54-0x0000000000090000-0x000000000015A000-memory.dmp

Download

memory/1340-56-0x0000000000090000-0x000000000015A000-memory.dmp

Download

memory/1340-63-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download

memory/1340-64-0x0000000000090000-0x000000000015A000-memory.dmp

Download

memory/1340-65-0x0000000000090000-0x000000000015A000-memory.dmp

Download