5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa

Analysis

max time kernel
183s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 18:23

Target

5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
Size

150KB
MD5

723187d38995646085285544130142d0
SHA1

3d5e478e2420e682198cc4f460f437170a6321ee
SHA256

5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa
SHA512

40845fb7b2f8cf5c20695e0b423b4d791a247f8b368065adab201d461cfdb12e80e0697f4aef38a00dfa0fd996aafa1c99647009e1915ec2279abbaf6d5da1bc
SSDEEP

3072:2w7GSzESqFXLo0X2/qe5gJ2Vnc5vww/TSUjinkSQ4GZm:RqSzxqFKy4VwIAobGM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81
PID 3008 wrote to memory of 4904	3008	5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe	81

C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
"C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe
  "C:\Users\Admin\AppData\Local\Temp\5274bbb3bc7d7a6c2b79f0d9e71db4f500caef080fd7a1dffcdeb2e81d8588fa.exe"
  2⤵
  PID:4904

memory/3008-134-0x0000000002160000-0x0000000002165000-memory.dmp

Filesize
20KB

Download
memory/4904-132-0x0000000000000000-mapping.dmp

Download
memory/4904-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download