569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77

Analysis

max time kernel
168s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:16

Target

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
Size

109KB
MD5

05d355677e0ded454d952b3eaf8c52fd
SHA1

df2d6da1168ca1fe3571f3a83f12bf061a3f19fd
SHA256

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77
SHA512

942cb3bbeccf8e67446ce7f9c37ddad8ae4bb69573eae00da15b0db83fc3d8aa2a9c6b797846eb90a53f01a568c69b11657defcdc0cc58d8eef3cb0a1a1d5d10
SSDEEP

1536:fAvmyHcD9m4kjaLDyRcYP8EYP2NVRJnlQyFKeBbLVDA:fAueuLDyRJ8ERNVRJlPFK4ZA

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe

description	pid	process	target process
PID 3036 set thread context of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe

description	pid	process	target process
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
PID 3036 wrote to memory of 4592	3036	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe	569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe

C:\Users\Admin\AppData\Local\Temp\569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
"C:\Users\Admin\AppData\Local\Temp\569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe
  "C:\Users\Admin\AppData\Local\Temp\569d990f0b13ab03698b4d8684fb0568c5450c791057f3c75eb19d7077e15b77.exe"
  2⤵
  PID:4592

memory/4592-132-0x0000000000000000-mapping.dmp

Download
memory/4592-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download