ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca

Analysis

max time kernel
154s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 11:54

Target

ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
Size

206KB
MD5

635a5aad75a562b40d9cd3e23f61bc77
SHA1

07718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256

ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA512

73fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
SSDEEP

3072:JUdas6F7Oq4W+qWFG/zY//HlIwFlbThSAFP2jfhld03iuRXCpSvFWBMuQVxtt3ZP:xp0GZenU+2jfdkiuBvvF1l5Fg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4980	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	82
PID 2232 wrote to memory of 4980	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	82
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83
PID 2232 wrote to memory of 4940	2232	ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe	83

C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
"C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
  "C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"
  2⤵
  PID:4940

memory/4940-133-0x0000000000000000-mapping.dmp

Download
memory/4940-134-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4940-135-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4940-136-0x00000000008A0000-0x0000000000B57000-memory.dmp

Filesize
2.7MB

Download
memory/4980-132-0x0000000000000000-mapping.dmp

Download