df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799

Analysis

max time kernel
130s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 15:27

Target

df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe
Size

298KB
MD5

145acf362594f134d60b607f5f41165b
SHA1

1f55cee3455485e4b9a32f993878d6e93cfccc79
SHA256

df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799
SHA512

c5e1ce79ae757eb8124c4dde14c5d202a4393204d36538777402f253a77917dab4067135509394601a48f21374a5b7c153bb87437c48388957341fe6c7d9e91f
SSDEEP

6144:+ZDIO9V0AsLrTSTZKvKA63R/3oUQ9K3aK5eI3DcFmHRnTIj:+dICVSLEA63N3oUQ9K3asxHRs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81
PID 4856 wrote to memory of 4720	4856	df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe	81

C:\Users\Admin\AppData\Local\Temp\df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe
"C:\Users\Admin\AppData\Local\Temp\df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe
  "C:\Users\Admin\AppData\Local\Temp\df5cbf0cf789cf9908bfda70f87096de2ea2826854d4f9254100b2a762590799.exe"
  2⤵
  PID:4720

memory/4720-133-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4720-134-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4720-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download