e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:27

Target

e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe
Size

255KB
MD5

492911437d231a94e0946786788842e0
SHA1

0849757e92ed0ee08fd2334be79fa26fce114cf4
SHA256

e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c
SHA512

ea2a6fde00a5322aab6dd16339e40736c7364efa0ea828123a60c01bb5fd0b14d7b9859cafee17240afd35214d192f3b1c292188d6a404f4cf7f0c9d6a6aa501
SSDEEP

6144:U+/F0Po0sWvm7AVpmSItLWIpmBn3inH0RPRk+20OKYAT/NfPW:Ptx0sRGpk1p2n3xP73TlfPW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83
PID 552 wrote to memory of 3792	552	e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe	83

C:\Users\Admin\AppData\Local\Temp\e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe
"C:\Users\Admin\AppData\Local\Temp\e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:552
- \??\c:\users\admin\appdata\local\temp\e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe
  "c:\users\admin\appdata\local\temp\e6cdf1f589050ffa7af72225df5b0d2457e3981af4b892330282285496412c0c.exe"
  2⤵
  PID:3792

memory/3792-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3792-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download