8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:41

Target

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
Size

249KB
MD5

3be7196a04429db531a99f71ab29837c
SHA1

d0e4817a447d696ab685f283329e6be87680db77
SHA256

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d
SHA512

ee8c2eceee60c8fd210ed80f5b6a94c83c98ee781ba7a43e1b11bb7b8d0d2c46fbc1ddec65467129b42ff1acf028354a780c1e599684265259ac2bece9a38867
SSDEEP

6144:WnrxN0zGWR1h1UBgmAzxsLKFSZi1MRX2reeXTHmX:WnV2zGWvh1UBgrV4KSEMRGrrzm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

description	pid	process	target process
PID 4964 set thread context of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

description	pid	process	target process
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
PID 4964 wrote to memory of 3252	4964	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe	8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe

\??\c:\users\admin\appdata\local\temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe
"c:\users\admin\appdata\local\temp\8ee93dffd21d31642c1c0acbcaa69541485c5fb296dc22454af735f7785ebf0d.exe"
2⤵
PID:3252

memory/3252-135-0x0000000000000000-mapping.dmp

Download
memory/3252-136-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3252-138-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download