305dbfd835c4c82c44c7a1c727d33ed6010dc4b6cda324ba3cd68eae7a94acfe

Analysis

max time kernel
75s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 13:51

Target
95dba5d8592ba5effec8c87ed4328e42.exe
Size 238KB
Sample220817-q5s9msgdaq
SHA256 305dbfd835c4c82c44c7a1c727d33ed6010dc4b6cda324ba3cd68eae7a94acfe
MD5 95dba5d8592ba5effec8c87ed4328e42
SHA1 4630bcfae24f24bc16e0d6f6f008b9882640a01a
SHA512 d75ccc356a6f9b5f132c463f72e85e6335b2fe1df04547e8a0405c0e0b93a9eed121f503a57a697987cad62db9da454283e175a64c1fab74836162fb86fa4b0b
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83
PID 4988 wrote to memory of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83
PID 4988 wrote to memory of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83
PID 4988 wrote to memory of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83
PID 4988 wrote to memory of 3308	4988	95dba5d8592ba5effec8c87ed4328e42.exe	83

C:\Users\Admin\AppData\Local\Temp\95dba5d8592ba5effec8c87ed4328e42.exe
"C:\Users\Admin\AppData\Local\Temp\95dba5d8592ba5effec8c87ed4328e42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3308

memory/3308-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3308-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4988-141-0x0000000000AC0000-0x0000000000AFD000-memory.dmp

Download