a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7

Analysis

max time kernel
144s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:29

Target

a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
Size

286KB
MD5

9943253862474976eba51e4e2a84a2fd
SHA1

b9e3108c7b63d09af4eee6e1d298806c60b97a11
SHA256

a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7
SHA512

2e5e50a79aa0de9434e740756bd4e18c7e106e4d42f99bb717d3d195cf3fae5445f567b906439b5ed69adddbca1f146556b63e9684c062a0b26934433543e653
SSDEEP

6144:woIt2+5kxPC4XbD+b33a0r1nm/vLT8oSzzVY:wR55kxhXbi33D1nm/vf7Mi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe

description	pid	process	target process
PID 4676 set thread context of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe

description	pid	process	target process
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
PID 4676 wrote to memory of 4068	4676	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe	a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe

C:\Users\Admin\AppData\Local\Temp\a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe
"C:\Users\Admin\AppData\Local\Temp\a451451057b71ae702ec9f0254466831bd67ea5aaa62fcaefbccf1f571a24bd7.exe"
2⤵
PID:4068

memory/4068-132-0x0000000000000000-mapping.dmp

Download
memory/4068-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4068-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4068-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download