f29204864222579ae1524265d697bbb19c910b95ffbc692f43f3420e92cfa4ee

Analysis

max time kernel
63s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 07:21

Target
startix.exe
Size 3.3MB
Sample221010-h6pc3sbab3
SHA256 f29204864222579ae1524265d697bbb19c910b95ffbc692f43f3420e92cfa4ee
MD5 73d0bd27f57c2ae7bca3cd1deb4d7960
SHA1 e9754cab3bf67db5920bdd53225c07ee8791ab57
SHA512 f3ae00c3ec9d3112f358d70450c5d97c0c6dbf6821d2646dca3a212a2940823157de70ef971ef5af2e4b90d4ef5a21eb3b03e5937bea1b761fa85833c88afdc8
SSDEEP 49152:tWyC5V+pGLKhLKk1KDQJKfHl17wLMPjwEl3/:tfCu8eB9Kt6LMPj/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 150592	1516	startix.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 150592	1516	startix.exe	83
PID 1516 wrote to memory of 150592	1516	startix.exe	83
PID 1516 wrote to memory of 150592	1516	startix.exe	83
PID 1516 wrote to memory of 150592	1516	startix.exe	83
PID 1516 wrote to memory of 150592	1516	startix.exe	83

C:\Users\Admin\AppData\Local\Temp\startix.exe
"C:\Users\Admin\AppData\Local\Temp\startix.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:150592

memory/150592-133-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/150592-139-0x0000000000400000-0x0000000000502000-memory.dmp

Download