a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 03:54

Target

a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe
Size

323KB
MD5

1030872f6251102f5772df9a7b1e7d6d
SHA1

765a18c6503df1618e56672d97b02d321469d195
SHA256

a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee
SHA512

e345b12793eb7c622d45e2bf2491827d812ff5010ba97973fef21297db6b3a129adb3efb7c9159426647c92e037d000a040e45f4fabe99b4835b11b20b6061a4
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81
PID 4956 wrote to memory of 4932	4956	a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe	81

C:\Users\Admin\AppData\Local\Temp\a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe
"C:\Users\Admin\AppData\Local\Temp\a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe
  C:\Users\Admin\AppData\Local\Temp\a5154d19b4442713c2e71d7ae9574a3495d9f4b728b7211983dd23a7601a84ee.exe
  2⤵
  PID:4932

memory/4932-138-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4956-132-0x0000000000760000-0x00000000007B6000-memory.dmp

Filesize
344KB

Download
memory/4956-133-0x0000000007C20000-0x00000000081C4000-memory.dmp

Filesize
5.6MB

Download
memory/4956-134-0x0000000007750000-0x00000000077E2000-memory.dmp

Filesize
584KB

Download
memory/4956-135-0x00000000079F0000-0x0000000007A66000-memory.dmp

Filesize
472KB

Download
memory/4956-136-0x00000000076F0000-0x000000000770E000-memory.dmp

Filesize
120KB

Download