f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 09:28

Target

f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
Size

578KB
MD5

0c30020a053f51cc33f33478462ad940
SHA1

8727ce1bb86a1038ae26395e2f9fe99a51559d4e
SHA256

f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121
SHA512

6d2161a8aa35f765e997c9b65fa39d0e892ed50a1bab1e86300061e5349b2f07caa6f75cd90b663584fa2efd9c1d1631692624509abc82a08e509eed3362b527
SSDEEP

12288:mRHQGHVgQvJr4X5f/0Q0nTzcBSl9YqbfhIM66Ci:qB3h4x0MwliyEE

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
4384	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
4052	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4384	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	80
PID 1748 wrote to memory of 4384	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	80
PID 1748 wrote to memory of 4384	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	80
PID 1748 wrote to memory of 4052	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	81
PID 1748 wrote to memory of 4052	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	81
PID 1748 wrote to memory of 4052	1748	f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe	81

C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
"C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4052

memory/1748-132-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1748-133-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1748-136-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4052-137-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4052-141-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4052-143-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4384-138-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4384-139-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4384-140-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/4384-142-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download