ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee

Analysis

max time kernel
105s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 17:52

Target

ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe
Size

37KB
MD5

40138f0fcb7ce7cac68320bcb0ae4580
SHA1

35106d53585b170dbbb956e5498731b93a1562c0
SHA256

ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee
SHA512

e94717209281dccf32c8402da5f0efe6895203bfcaf623f95bb0760336f2c5e0c9d134023b25f2b4fa2477c58456111879c6fc5e5db51aae027c8f2a15e573a3
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMyg:edILlknNU4rOobbLyng

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3136 set thread context of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
640	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe
640	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84
PID 3136 wrote to memory of 640	3136	ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe	84

C:\Users\Admin\AppData\Local\Temp\ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe
"C:\Users\Admin\AppData\Local\Temp\ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe
  "C:\Users\Admin\AppData\Local\Temp\ace41064895b9f95cae84724ec674bb2181b784af96904882e1c59677269bcee.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

memory/640-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/640-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/640-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download