78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:26 UTC

Target

78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
Size

285KB
MD5

dfce3d57c83c019f263d3e8f3c6b8f39
SHA1

41d6e29f16b3ad5c6a4afd54633b55dc844d72e2
SHA256

78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc
SHA512

3fd97d32601f68f2f482fe265d27b1a12a1d4b6279e21bb47e0cc4b0d826387e6dc5e8e44add838549405e2e0acdbb8af05d0da74dd4a1fcbc731ec738cb564d
SSDEEP

6144:EX6BDomz60SRPgwPiEe3JtKeju6dM00MmxoMul8jX:5D9z60gPs3JXTddmP2c

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84
PID 2788 wrote to memory of 5084	2788	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	84

C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
"C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
  C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
  2⤵
  PID:5084

memory/5084-133-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5084-135-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download