26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985

Analysis

max time kernel
136s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 19:24

Target

26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe
Size

355KB
MD5

495ca21a26b6b070450c614ae12b2d1b
SHA1

de89e4cb57c19109d7b7a89623fc3ccc3ea31257
SHA256

26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985
SHA512

728ef34597a42e9f2c191fa46253ba40c97c9561693aded01733c73587d8d980822583a8cfa52d7bc24f4e1d413ee844ac432306b7dfdef38f5288a4dbd075ed
SSDEEP

6144:QcpFrN4p9/5mOeBBBhMwgQj1SHp89fL+3ApBVSs+jukWU1:fn2vg/NhM9p89fL+wpBVEV1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79
PID 1940 wrote to memory of 2920	1940	26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe	79

C:\Users\Admin\AppData\Local\Temp\26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe
"C:\Users\Admin\AppData\Local\Temp\26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe
  "C:\Users\Admin\AppData\Local\Temp\26a070357b84d7ffe926a233ea3f3233a10e52f6256345915c7d2da8c0daa985.exe"
  2⤵
  PID:2920

memory/1940-132-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1940-135-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2920-134-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2920-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download