119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773

Analysis

max time kernel
104s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 06:12

Target

119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe
Size

301KB
MD5

774dc89099848cc76cab1fc335124490
SHA1

a0422e6db7d094b8c32f1cb4a1e93df1bf1199bb
SHA256

119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773
SHA512

6019a60cf9abd59f0671949d7027cbda9477e35b2a355560ea056dec6407ce3c58740cb0660752aebba904f3af88b7c6d0c596c9c031c2b13890e6d04ff6a3c6
SSDEEP

6144:YTP1vk8mAMueZJVpry6w8me66ZhdZbD34BMYNubu:YzC8mAReZJVVBw4ZVqMVa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3400 set thread context of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84
PID 3400 wrote to memory of 1480	3400	119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe	84

C:\Users\Admin\AppData\Local\Temp\119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe
"C:\Users\Admin\AppData\Local\Temp\119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400
- \??\c:\users\admin\appdata\local\temp\119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe
  "c:\users\admin\appdata\local\temp\119c8a4b67dae97f2736c66f43005bdfbc531747b736324bde5ca9859d5b9773.exe"
  2⤵
  PID:1480

memory/1480-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1480-134-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1480-135-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1480-136-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1480-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download