334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc

Analysis

max time kernel
236s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:16

Target

334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe
Size

1.3MB
MD5

00055c400951c7fbd79bcc7102cb0eb0
SHA1

52fbb92964f3554c46c1f8d764f0d651b53bf967
SHA256

334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc
SHA512

e71f4626f9a27809d8a0952bc3f2ef42f2f7f6bc2b4d61184f5271798f64d33eae3cd24fc15cfc58bc8d4028f91c510449f98158ed159b056681efa913cfeaea
SSDEEP

24576:Hprt9au8OGecdnpCmHPaKkdxyHPHVs/twDy0YxbHcvvO48:HwdnBTkdx6HVs/+8xe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4016 set thread context of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81
PID 4016 wrote to memory of 5072	4016	334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe	81

C:\Users\Admin\AppData\Local\Temp\334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe
"C:\Users\Admin\AppData\Local\Temp\334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\334ce16451479169bcc181c4554b5ff214833d26c0977ad0ed7cfc5ec27e1ebc.exe
  2⤵
  PID:5072

memory/5072-133-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5072-135-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download