aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72

Analysis

max time kernel
150s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 19:35

Target

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
Size

112KB
MD5

6a37d9a8389337d37523d16b2c502db0
SHA1

1ca9b32ba7dac66d47431975daeeb90165893715
SHA256

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72
SHA512

fc70d44614f68b5772faab89216391be849b9e35e36ec70e68ff28c421013cdc2b8779368358c5ee2919478556603fa6d8fb035be791dc886d3f5d3de127f32d
SSDEEP

3072:r6IuIt6lTnc7oh1FKMw1NPItHgEQSyGhjXsP:PuIt6lI7mKMwHTSts

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

description	pid	process	target process
PID 4564 set thread context of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

description	pid	process	target process
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
PID 4564 wrote to memory of 4968	4564	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe	aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe

C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe
"C:\Users\Admin\AppData\Local\Temp\aea3ef2e0d81cc90ad57e984cb33ea239ad8dbb85e7cdcaae11125428bea9e72.exe"
2⤵
PID:4968

memory/4564-132-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-134-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/4968-133-0x0000000000000000-mapping.dmp

Download
memory/4968-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download