bfbee93177edcd85c7406e28ea0edbf3e83bf4d608bbce8a7b24064eec5b822d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 07:45

Target
7dc5811b2d3c618537c11ecff1dbe363.exe
Size 721KB
Sample220818-jldlhsede7
SHA256 bfbee93177edcd85c7406e28ea0edbf3e83bf4d608bbce8a7b24064eec5b822d
MD5 7dc5811b2d3c618537c11ecff1dbe363
SHA1 852c892e8ef8559c7ca0227c69a5e20755d06200
SHA512 09a5b68f6e35a2977bf9ee7cb04626dd3330652aef54e2744d575ab356eaf75d542763521d2c4309c7efb2e072a1c2bca6e845ce34287b6d36b6d57acb7e6dc3
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	7dc5811b2d3c618537c11ecff1dbe363.exe
3504	7dc5811b2d3c618537c11ecff1dbe363.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83
PID 3972 wrote to memory of 3504	3972	7dc5811b2d3c618537c11ecff1dbe363.exe	83

C:\Users\Admin\AppData\Local\Temp\7dc5811b2d3c618537c11ecff1dbe363.exe
"C:\Users\Admin\AppData\Local\Temp\7dc5811b2d3c618537c11ecff1dbe363.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\7dc5811b2d3c618537c11ecff1dbe363.exe
  "C:\Users\Admin\AppData\Local\Temp\7dc5811b2d3c618537c11ecff1dbe363.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

memory/3504-138-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3504-139-0x0000000001500000-0x000000000184A000-memory.dmp

Download

memory/3972-132-0x0000000000CA0000-0x0000000000D5A000-memory.dmp

Download

memory/3972-133-0x0000000005BF0000-0x0000000006194000-memory.dmp

Download

memory/3972-134-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/3972-135-0x0000000005700000-0x000000000570A000-memory.dmp

Download

memory/3972-136-0x0000000007990000-0x0000000007A2C000-memory.dmp

Download