f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52

Analysis

max time kernel
88s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 08:41

Target

f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe
Size

287KB
MD5

6e07f09dede1908e6506f9975221e7b0
SHA1

06329ea00f56556f4325301735f16b4d81409f4f
SHA256

f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52
SHA512

64dddd5d78cd536000661ef0d0fc296e9170f6d7722bb43a87f1ad566d9f1477e9a8d7689442036b415fd0f9924c970dcde896a71ef273d74bdd0085b96e1f37
SSDEEP

6144:6VIuBVQNYUoMQeCw2+kHNFIe/7sCVjKlYjVkHcvuedc/KEU9K5QK:GzQNYJBylxcVj4YjVLvunKEUU5t

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81
PID 4644 wrote to memory of 5080	4644	f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe	81

C:\Users\Admin\AppData\Local\Temp\f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe
"C:\Users\Admin\AppData\Local\Temp\f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe
  C:\Users\Admin\AppData\Local\Temp\f1048afbda4d2be7d4a7566d42603f68977c6cbd96e521ad34824a744d9aef52.exe
  2⤵
  PID:5080

memory/5080-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5080-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5080-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download