9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 11:29

Target

9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
Size

169KB
MD5

0a578b57112b45cc0233c8e3278f752d
SHA1

a9098db5a56714f72eac8d34142d9044aab372e2
SHA256

9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca
SHA512

3def4b38735ba5418f00e1c8f043a586d7e585d6eef6b54489c977ee1ec32b0a998f3e6c3dbf5b875d5a82980d5c47d15ebcad4b2e1e0c564de5379acb6d1f3a
SSDEEP

3072:iKXR/zNqhJpCGXwxK3wgZci6BbJVyjZdyHdJWheQGyT6pVTIOk/qTELtVN1UJnry:iKBRsJpP3XZci6B9VeZdyHCeQGHpyOoZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3836 set thread context of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85
PID 3836 wrote to memory of 4832	3836	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	85

C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
"C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
  C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
  2⤵
  PID:4832

memory/4832-133-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4832-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4832-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download