f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:12

Target

f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe
Size

69KB
MD5

cee8b295bcd78785d24e75f2d553850f
SHA1

96152414c813785a51ff0196ea0c49394f2c0b42
SHA256

f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1
SHA512

83359d2a03867a6441b0c1dfcdf352e3cc8bce9ff5b24091e6ae2e4e68050682edf6433554beded6df285099a1e8d6871feb64314d8d58b22e53e685d2c99ca2
SSDEEP

1536:I3RNYSo9O+NQGhrRSVV1pXNocW9YcahizM32HOYeLa:I30SB+1Bip9T+8izKOOm

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2276	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	80
PID 2148 wrote to memory of 2276	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	80
PID 2148 wrote to memory of 2276	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	80
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81
PID 2148 wrote to memory of 3188	2148	f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe	81

C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe
"C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe
  "C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe"
  2⤵
  PID:2276
- C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe
  "C:\Users\Admin\AppData\Local\Temp\f66cf27386ee1e00b921d8b819aea1fd55532358ede7c2f16bbc0379b8dd65b1.exe"
  2⤵
  PID:3188

memory/2148-132-0x0000000075500000-0x0000000075AB1000-memory.dmp

Filesize
5.7MB

Download
memory/2148-134-0x0000000075500000-0x0000000075AB1000-memory.dmp

Filesize
5.7MB

Download
memory/3188-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download