a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:34

Target

a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe
Size

87KB
MD5

047ff12bcdfc2d271b6fe970c492acfc
SHA1

4656aa177c2dc7750015645b1cab21330c23bf95
SHA256

a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580
SHA512

7b5f377d267cdf3be92d78f9f064a5b3d9e618b9251c7128b47ffaecb2548255a76bdf692ce3796b2c366d29bb7c5d153c507be4dc132fcf8df78d23ccb41649
SSDEEP

1536:zkIiwKMDFwHmWd/+4vW2/dCym2SoYTShX2Lwx1SVzHziHLeuC1lT0KS4+:IEwHmqW4vW2/NmJdpLgoHeLeuCry

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q1miiduu.exe	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q1miiduu.exe	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3364	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe
3364	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83
PID 4584 wrote to memory of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83
PID 4584 wrote to memory of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83
PID 4584 wrote to memory of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83
PID 4584 wrote to memory of 3364	4584	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	83
PID 3364 wrote to memory of 3052	3364	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	42
PID 3364 wrote to memory of 3052	3364	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	42
PID 3364 wrote to memory of 3052	3364	a4923a63b0a3a1fce74796c368a637cc4da15d94194077e243fa26ff4a0d2580.exe	42

memory/3364-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3364-139-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3364-141-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4584-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4584-133-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4584-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4584-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4584-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download