d184612e2f0b0b065986b94869296330d56e356e2d1ef077461e064bdcb4d3a2

Analysis

max time kernel
66s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 11:56

Target
c3639b03db35e759ea90588f6a1f4aaa.exe
Size 238KB
Sample220817-n31jtsfbej
SHA256 d184612e2f0b0b065986b94869296330d56e356e2d1ef077461e064bdcb4d3a2
MD5 c3639b03db35e759ea90588f6a1f4aaa
SHA1 8cfccf815a0af8e8b893101d677c35caa7e76751
SHA512 99c17cc723a10895beddaf56aacfbc9cb7772b82794d2772a33847e507f5c2d7be8c12fb6bfa22d53c61288f8abb13cc2adaaa65a7f9e4db239e46745b340f7e
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4076 set thread context of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82
PID 4076 wrote to memory of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82
PID 4076 wrote to memory of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82
PID 4076 wrote to memory of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82
PID 4076 wrote to memory of 1984	4076	c3639b03db35e759ea90588f6a1f4aaa.exe	82

C:\Users\Admin\AppData\Local\Temp\c3639b03db35e759ea90588f6a1f4aaa.exe
"C:\Users\Admin\AppData\Local\Temp\c3639b03db35e759ea90588f6a1f4aaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1984

memory/1984-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1984-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4076-141-0x0000000000040000-0x000000000007D000-memory.dmp

Download