4901458729d9f901ec6e7ca5dc22b06434b5c966fb9c281d72ea873707fa4579

Analysis

max time kernel
79s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2022, 15:15

Target
file.exe
Size 1.6MB
Sample220902-smwcdsfhdq
SHA256 4901458729d9f901ec6e7ca5dc22b06434b5c966fb9c281d72ea873707fa4579
MD5 507c5d8ded0af41fbec0b084e3cfe5c7
SHA1 614d3b669b34af0a6918fc87fa37386ba717f7e8
SHA512 722705fbf2b4ae6069f8648b537224d7d66114e4f6c63790d93bed2f34fd3ab340ac7f7ef43a6a07f67d620a437a8ff6ad6eed08df7e29a9caeaca822e498e97
SSDEEP 24576:eyOnY+YBIzm4OMb7ohMrmNeQkxljvCg/BO+PzTfXiVBlf2zs+coXcaDp:eyZqKQjvCYZPHfXiVBlfIXXcsp
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4968 set thread context of 154240	4968	file.exe	79

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 154240	4968	file.exe	79
PID 4968 wrote to memory of 154240	4968	file.exe	79
PID 4968 wrote to memory of 154240	4968	file.exe	79
PID 4968 wrote to memory of 154240	4968	file.exe	79
PID 4968 wrote to memory of 154240	4968	file.exe	79

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:154240

memory/4968-138-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/4968-142-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/154240-133-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/154240-141-0x0000000000400000-0x00000000004A2000-memory.dmp

Download