9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996

Analysis

max time kernel
122s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:37

Target

9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
Size

576KB
MD5

102f924661a4788b3779c98c3f4729e0
SHA1

07a00ddb67eacc5052ab914f8969940730839362
SHA256

9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996
SHA512

a0863f92bc1c5f8c9a433a64258e56664a12243a1bef741b61eebb47baaee3443bc038d9a17cdc44298c14fa137cc7dbcb23b0ec44f98afc98bdbb99f95d6349
SSDEEP

6144:y7lB27PYyYWIei23/lyl+GApU7ucEvsXGrNJ0gHnd2qNXggiuB/M/DlghHbN4zHe:ycPwT2PloKcEYo0Yggnos0todLnmMl

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
3500	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
3964	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3500	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	78
PID 2076 wrote to memory of 3500	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	78
PID 2076 wrote to memory of 3500	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	78
PID 2076 wrote to memory of 3964	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	79
PID 2076 wrote to memory of 3964	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	79
PID 2076 wrote to memory of 3964	2076	9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe	79

C:\Users\Admin\AppData\Local\Temp\9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
"C:\Users\Admin\AppData\Local\Temp\9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\9d8d0c90b0fc5c3343a7f615c01f16cb859ef6fa37e46cdad9548787489f0996.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3964

memory/2076-132-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2076-133-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2076-134-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2076-139-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3500-137-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3500-140-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3964-138-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3964-141-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download