b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 07:40

Target

b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
Size

262KB
MD5

0a8eca7c20b825fd754879c64009817e
SHA1

a25f775838797d5c90cf7cbb5895d2457d2fb067
SHA256

b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f
SHA512

a7f8d60cf011a33bd5233029777dcc9fec528b5df97acff48aabe8a7148277b0abf25efaa12f841717953fc1ea00c87a28c430cfd2160d7015019863141fc07f
SSDEEP

6144:c1azDD9YMjfxZWT2oSEe9laHxmN001lda:cSH9KzFe9cRmNf/A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80
PID 1812 wrote to memory of 5028	1812	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	80

C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
"C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
  "C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe"
  2⤵
  PID:5028

memory/1812-132-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1812-136-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/5028-134-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5028-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5028-138-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download