945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd

Analysis

max time kernel
160s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:38

Target

945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
Size

183KB
MD5

abe5c0a299ffffb1a7b29bd3ea6fc86c
SHA1

11c08a46161c9c1e13c5b10dda277309f1547429
SHA256

945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd
SHA512

04d5c5cf69b64adcdac89fea0f3559939cdf2630780061b60bab89a930924e9e8f0b8f17c7ca2e0a544cfc8f935e6e021262ff6bdf7a9e9525694223f57deaaa
SSDEEP

3072:YLpxTJJWCXx7vCgiFuCiSxS+0qHEC1yhlb4+nFHz6PTGDG:Yt9RdvCgVL4+19q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

description	pid	process	target process
PID 3376 set thread context of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

pid	process
3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

description	pid	process	target process
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
PID 3376 wrote to memory of 4852	3376	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe	945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe

C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe
"C:\Users\Admin\AppData\Local\Temp\945325c717a4a160ab6a0a64e216fbc86b229996bf90f438f9b49a9fb51643bd.exe"
2⤵
PID:4852

memory/4852-132-0x0000000000000000-mapping.dmp

Download
memory/4852-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download