e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 21:51

Target

e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe
Size

124KB
MD5

849b9bc125594a28a5614162b57909db
SHA1

4c0b59fa4ac96e03342cbdc36f0752b5632b1c52
SHA256

e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06
SHA512

86c0b8d84a26b34bcb2e09381fe0adbb8d630850b74c8042bc1e98e8479eac064b5f02bfb1f020477cdccba22e30d24b172b71c902888b6f25485d29eee0d3c6
SSDEEP

1536:/tPr2/kPKMonowh4ooFoNyhUICkT2rLtp4fNGtJ2d9DUMymuGFYp4Py+i6m6jP:/9PPnonoroomISrLtpgNXdyp6m6jP

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4880 set thread context of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82
PID 4880 wrote to memory of 5020	4880	e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe	82

C:\Users\Admin\AppData\Local\Temp\e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe
"C:\Users\Admin\AppData\Local\Temp\e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe
  "C:\Users\Admin\AppData\Local\Temp\e3573366c867bf88c2f518ba84dbbe609e32f84e892212ebfb0f4697511e3a06.exe"
  2⤵
  PID:5020

memory/5020-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5020-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5020-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5020-137-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download