2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2

Analysis

max time kernel
100s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 11:06

Target

2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
Size

166KB
MD5

bf45f27a403acfd3847fbbae88a8375f
SHA1

06bd4a8895b0dd88a04e7de03e3f1f362e33d518
SHA256

2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2
SHA512

d851d35fd317fd1dfaf7deb6c5e2530af38976271d859cc81532bd9e7c766fccbb24ca0063c3336be29597617da96e92a6da688e4c26c4f17294f8ce45cb42c0
SSDEEP

3072:4cNLL5QPHSlkC0y3fOl0W7nbiCIiptMm7SmAXNzSrCdIfUEyPnmVhOQVEX4:4cNLLyvSlWy3e7nVjtMInGCsE2YkQV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80
PID 364 wrote to memory of 2612	364	2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe	80

C:\Users\Admin\AppData\Local\Temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
"C:\Users\Admin\AppData\Local\Temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364
- \??\c:\users\admin\appdata\local\temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
  "c:\users\admin\appdata\local\temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"
  2⤵
  PID:2612

memory/2612-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2612-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download