ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47

Analysis

max time kernel
161s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 17:00

Target

ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe
Size

253KB
MD5

bd4ea9ba0bd935e93c27ebcc0cc8b322
SHA1

d2c8f6a44eeb61d5cf3de76c4936aed1455809b5
SHA256

ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47
SHA512

2a3dc237927d5e7038a5fdbc80618e5f79a7195406615682331e24af046f696181e0fc2d193df5717987999596edc8d72433d1860393bac1a8010c7721dd8128
SSDEEP

6144:ZNfRWMh8287YX82VtzXCl2GbwzQZo/nPIzspErWE6uDG2uusVMWLc2Ck2Rpz5Ab:ZZhh78Q8IzXCl2GEluG72R

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79
PID 800 wrote to memory of 2980	800	ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe	79

C:\Users\Admin\AppData\Local\Temp\ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe
"C:\Users\Admin\AppData\Local\Temp\ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe
  "C:\Users\Admin\AppData\Local\Temp\ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe"
  2⤵
  PID:2980

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ee6a4ae017a7ba9ce9f4df6cbce7cda83822cea52612c8a28889cf4d0fb22f47.exe.log

Filesize
223B

MD5
cde6529abeea500fb852f29ba0da6115

SHA1
45f2f48492417ae6a0eade8aaa808d3d1d760743

SHA256
d7f4964443470b6729865676d76f5f1f416da633033071c34ea5eb19cdea53b5

SHA512
c95fa7faf6a90f32060dba70f79c4d66c68d6eec587306fb98f36fc3ba5d377ebf9dabf47298b71db208fb10f7ccb4e0ed82236c8f26bcc746552588bbb38234

Download Submit
memory/800-134-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/800-136-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2980-135-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2980-137-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2980-139-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download