3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c

Analysis

max time kernel
106s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:02

Target

3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe
Size

248KB
MD5

05f04d69ffe7511db5f18c8b9ceef001
SHA1

8decc21de1d82352af5a3e3bd11547abb863c596
SHA256

3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c
SHA512

03f017706e0b4b4393ce560cefe15e2b74df2ef6ba393744ab241897bbbae2884cd2e73cd8e1ef796dffb1ec48284388ccfc8ca00722623d27ac5299cd9393f0
SSDEEP

6144:T1gGbCsiSB0VE/4+AbiuRYIk9xpzHKMOPcVBKGQeVGa0DFYIrWY:TGlLt/LLUpzqM1VBK9eVG/FXrWY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87
PID 2064 wrote to memory of 3980	2064	3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe	87

C:\Users\Admin\AppData\Local\Temp\3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe
"C:\Users\Admin\AppData\Local\Temp\3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe
  "C:\Users\Admin\AppData\Local\Temp\3002723984a4aa402a26c4b7bc3f1e495c1777ab3418f14c6a9308de75bb479c.exe"
  2⤵
  PID:3980

memory/3980-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3980-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download