1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b

Analysis

max time kernel
150s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:36

Target

1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
Size

483KB
MD5

cc6508c655aa5ad24cee66148b841d87
SHA1

9c845c777287c9048cef6838416b54259f8d7eab
SHA256

1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b
SHA512

a49636bf7e60e876757d148473279298c8eb0c5d34a3e2aec0de8416f1885a3664cb8364212b49a277e01abfa6ade76a1d25c52939f7a97c1c38fe16cea95312
SSDEEP

12288:PH/5rxiLJgVTFZNg+aU/UBrxiLJgVTFZNg+aU/Uh:PnUqVTTN5aU/UHUqVTTN5aU/Uh

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

description	pid	process	target process
PID 3748 set thread context of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

pid process

3748 1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

pid	process
3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

description	pid	process	target process
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
PID 3748 wrote to memory of 3456	3748	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe	1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe

C:\Users\Admin\AppData\Local\Temp\1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe
"C:\Users\Admin\AppData\Local\Temp\1bf1e0b4de0df75aa6508dc992d5b51493c16b1cc44d8147f6d58d2de582a52b.exe"
2⤵
PID:3456

memory/3456-132-0x0000000000000000-mapping.dmp

Download
memory/3456-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3456-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3456-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download