d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c

Analysis

max time kernel
108s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 06:58

Target

d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
Size

102KB
MD5

dbcf6d36bd7eedbb2cd7720b39960c7f
SHA1

56f29db2016122359d1d8a71bcbb06573f0350c1
SHA256

d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c
SHA512

963a7711cd4aa2d60486e7fb0d9f05e193073655c9426336f813c905c0cf6cd917ee72c20c6560ae9a0d093a99fbfb8e1b939c09d2bb0ba86cb64d75e7ee7117
SSDEEP

1536:8KIB3GOEsRZYlFww57h30CktP9vyO/S6HTVyAobKhOCtyvR8LnGWCH7aEKvQ:8rB3GDsRZOZQ9vd/3HRy0Ov8LnIaRvQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

description	pid	process	target process
PID 3260 set thread context of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

pid	process
3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

description	pid	process	target process
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
PID 3260 wrote to memory of 1476	3260	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe	d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe

C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe
"C:\Users\Admin\AppData\Local\Temp\d7abcf8bc25843b59ad6afba686bd32e0b34f3486edca033495ecec1c1416b8c.exe"
2⤵
PID:1476

memory/1476-132-0x0000000000000000-mapping.dmp

Download
memory/1476-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3260-134-0x0000000002150000-0x0000000002155000-memory.dmp

Filesize
20KB

Download