b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 22:08

Target

b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
Size

312KB
MD5

841028275dccd25dfdec53de87e0998a
SHA1

300e29d5e857dc7d3250ce03e32511efb9f05e33
SHA256

b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a
SHA512

c18000cdb2f571fbee1ebb3c31c1b4f1bd399379a50cd02a1660c3b435d2ae2058250853a9b43bec34fcfab3092189d3c38cda3f43dc24db273362d7845a867d
SSDEEP

6144:LHJStC7lsCyl+UTjmHa7M0Zxb/r2RJOpKIy+FRW62BNS9SXU3f3fnAA8:LgtCRsCy+KaHj0/rtbdoMq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82
PID 4392 wrote to memory of 4060	4392	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	82

C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
"C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
  "C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe"
  2⤵
  PID:4060

memory/4060-132-0x0000000000000000-mapping.dmp

Download
memory/4060-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4060-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download