6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc

Analysis

max time kernel
259s
max time network
339s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:58

Target

6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
Size

483KB
MD5

082ba9caf9a8bb47690e15713dc0767d
SHA1

4240f04cbc25816f02a434f73416a6438fe1235c
SHA256

6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc
SHA512

bc98426cbfe9ac5ed015ab1b841ffb6422117e47b6b088eb424e2ccfa327b6027908a268fccdc71dd5dd5730f8cd8832421b5cf98d898b71eeab5d1325dd1af7
SSDEEP

12288:PH/D9lSj7eGkTfsx5vzQt6jKew9lSj7eGkTfsx5vzQt6jKa:Pr9A32fsxJzQtyKJ9A32fsxJzQtyKa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

description	pid	process	target process
PID 632 set thread context of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

pid process

632 6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

pid	process
632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

description	pid	process	target process
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
PID 632 wrote to memory of 4544	632	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe	6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe

C:\Users\Admin\AppData\Local\Temp\6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe
"C:\Users\Admin\AppData\Local\Temp\6009a425bf85982c62ccf8297d4e8808a6ad855f248b96f02116b707175783dc.exe"
2⤵
PID:4544

memory/4544-132-0x0000000000000000-mapping.dmp

Download
memory/4544-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4544-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4544-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download