871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e

Analysis

max time kernel
204s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:59

Target

871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
Size

506KB
MD5

7adf721535d5dd7248a6432c8972ed52
SHA1

5a15b724ab4d656012c723f6e6e43a4a0ce8c32d
SHA256

871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e
SHA512

51647fb09887a2a3c36f9b54ed96beecb6b5ae9fd4a545f4961ca28324cf695d9909c3af0363ab4ff5a63553bd93789a0ab23296729a3b167e6b6eeb80d8cf02
SSDEEP

6144:FuLziM8pQnuuudy/TuuuZqcoxBIU9CdGKuuuegVgGo3OA2mABaQvUDmcxs2D1aPQ:FuniMIyCRcB5CdGq9GhA278DhyPGse

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe

description	pid	process	target process
PID 692 set thread context of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe

description	pid	process	target process
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
PID 692 wrote to memory of 1664	692	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe	871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe

C:\Users\Admin\AppData\Local\Temp\871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe
"C:\Users\Admin\AppData\Local\Temp\871ebe860253b821b5f7b5ffc6da4bb1289330b3e31536703cd3cd68d52e8e8e.exe"
2⤵
PID:1664

memory/1664-132-0x0000000000000000-mapping.dmp

Download
memory/1664-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1664-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1664-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download