2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 03:29

Target

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
Size

124KB
MD5

67bfacc799c2ca65a240bda33380638f
SHA1

901a17800fa7e5fbead96ffdac353e35870a11ae
SHA256

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c
SHA512

35d821603e7cff6ca80d8266890a2f09b00fe024e6ec6c1d563d4af4e6962aaabb13ff32fa50fbca0f3442d7da51bc82732ea5666db5fb72423af0ea7022e15c
SSDEEP

3072:pWVQttnaywTOmUeEgwnMjxTHyyz+HcwiYz1:pWVQ5Wz0nMZ+8wiM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

description	pid	process	target process
PID 2168 set thread context of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

pid	process
2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

description	pid	process	target process
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
PID 2168 wrote to memory of 4924	2168	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe	2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe

C:\Users\Admin\AppData\Local\Temp\2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe
"C:\Users\Admin\AppData\Local\Temp\2ac88f0e7c5ff57c7f8456e40af324f522abbc431058740d83000446d6e40c1c.exe"
2⤵
PID:4924

memory/2168-134-0x0000000002160000-0x0000000002165000-memory.dmp

Filesize
20KB

Download
memory/4924-132-0x0000000000000000-mapping.dmp

Download
memory/4924-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download