8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:11

Target

8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe
Size

235KB
MD5

1107b139cb1a369b5e3a05f669b8c0d3
SHA1

c5633f28f213dc5a8018603b19b004bf027192a4
SHA256

8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678
SHA512

2cf48961018f053d42b9438a0befa33f09f7b482a6515d81bc968a50a27ae79cd5a03da9731aedbcf7f76ec41cce36601d48b9c63cf71018dce7e578e04baa88
SSDEEP

6144:BpMrLyyASdV5KvMe6MWnHBMZcGMicceN+:sAg5KvM7NHETcceN+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78
PID 916 wrote to memory of 2880	916	8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe	78

C:\Users\Admin\AppData\Local\Temp\8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe
"C:\Users\Admin\AppData\Local\Temp\8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe
  "C:\Users\Admin\AppData\Local\Temp\8cda54406150e0430f459f82ce1d8e31258841334977407ade3ad14a85dfa678.exe"
  2⤵
  PID:2880

memory/916-133-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/916-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2880-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2880-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2880-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2880-139-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download