efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21

Analysis

max time kernel
172s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 17:33

Target

efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe
Size

229KB
MD5

f9d45de79103a051c4cc0266d141c761
SHA1

1dcd6f92873a447cf955c0d5d8ecd2e59c05e38b
SHA256

efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21
SHA512

3aaa1575054772d21d08983d03a5fb16deba4cec32f1b0b04b3b580377fe8bcec7cdbd9c0b90b67a732d585e9600d9298cc0be27c1cca6d18082dfddabe8fb06
SSDEEP

6144:U49FZrTSgJBz889LM/9ybeca7OfyJnRcXeB:U49FZrTf06MFEecAOydRcX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84
PID 1260 wrote to memory of 336	1260	efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe	84

C:\Users\Admin\AppData\Local\Temp\efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe
"C:\Users\Admin\AppData\Local\Temp\efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe
  "C:\Users\Admin\AppData\Local\Temp\efe15ea1343fe9e5dea3d181fdceb630db7a77ffb251fefb0364e42087774e21.exe"
  2⤵
  PID:336

memory/336-133-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/336-135-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download