eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:45

Target

eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
Size

277KB
MD5

44ebb36dff4d2cdf4794a96f44ecef68
SHA1

baae1171a2d62c7e29df35ef315d96e03bd019a3
SHA256

eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b
SHA512

2e2a442cb892dde88819a029c301b1d82c6b5538d90f07f1e2fcdf6de86f0c903049bd72754ecd9cbbf0d076e10b564b73a0ed2a95ee2cb3ea7ae3132d3b0806
SSDEEP

6144:hIlm7RoGCT/x8alQOGsNybWXjw5hvh6kW8j3w0igTDTpyvZ5:1ib/x8alQOjNbj+sf8jtvdyR5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe

description	pid	process	target process
PID 4476 set thread context of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe

description	pid	process	target process
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
PID 4476 wrote to memory of 460	4476	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe	eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe

C:\Users\Admin\AppData\Local\Temp\eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe
"C:\Users\Admin\AppData\Local\Temp\eb3d29428827b9afb9f2ccc7b1d6a8d4eb9c6d3ebc9df86f723b762ef9e48f7b.exe"
2⤵
PID:460

memory/460-133-0x0000000000000000-mapping.dmp

Download
memory/460-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/460-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4476-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4476-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download