b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:20

Target

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
Size

158KB
MD5

55cf1b172599ae1399e7bfd0a671dacb
SHA1

2f4c1211e9bfaf92340af0cb87e4d36b71225490
SHA256

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e
SHA512

5e766ca4dd255628410672008639d949a8653d9497220500b2c0880106e05d8365a027ae6eec04f1e93a5bdc36772eb33ad8f03ba05faa1270d39966bbaf3138
SSDEEP

3072:fp05OSx+nkwOu9Rs3m1FvBcMPNEFrOXkj49B1w:fdKwkwOERsQPNZ0Ae

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe

description	pid	process	target process
PID 2688 set thread context of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe

description	pid	process	target process
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
PID 2688 wrote to memory of 4880	2688	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe	b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe

C:\Users\Admin\AppData\Local\Temp\b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
"C:\Users\Admin\AppData\Local\Temp\b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe
  "C:\Users\Admin\AppData\Local\Temp\b3311788693b6f70a352c6460663050c57979e412e9fa38ed8d5dd149dc7952e.exe"
  2⤵
  PID:4880

memory/2688-134-0x0000000000580000-0x0000000000585000-memory.dmp

Filesize
20KB

Download
memory/4880-132-0x0000000000000000-mapping.dmp

Download
memory/4880-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download