e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f100e3aca30d7ae4fd71e3

Analysis

max time kernel
106s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2022, 09:41

Target
e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe
Size 389KB
Sample220819-lnrx2abefj
SHA256 e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f100e3aca30d7ae4fd71e3
MD5 0f0f3d6002656a999219d947eb1f89f6
SHA1 01a438f4743978385a08a5d59400503cfb39410d
SHA512 706e7e2ed8fbc7ba72950ec60eec575bd13811d6b0e5d7daf7710ffa6d8d09c341716c3c9f4885e524978321fb5f6726fb520352cb66993200f180c41a7633b4
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84
PID 4960 wrote to memory of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84
PID 4960 wrote to memory of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84
PID 4960 wrote to memory of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84
PID 4960 wrote to memory of 2764	4960	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	84

C:\Users\Admin\AppData\Local\Temp\e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe
"C:\Users\Admin\AppData\Local\Temp\e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2764

memory/2764-133-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2764-140-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4960-141-0x00000000002B0000-0x0000000000314000-memory.dmp

Download