74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 07:46

Target

74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe
Size

190KB
MD5

dc29903126dc25b507e6acb19b0f9862
SHA1

7141ab5de0350991254954796b1fcc0b28a3d84d
SHA256

74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5
SHA512

99ceed709ff37fc4c7827d99d4e2dbc8f441517cf0fec618fa551c684d9f502c8e7f03faa8b49a483dfdf029cc33f29c183daa6bf7a5e49c6050588fba9654f3
SSDEEP

3072:te7HhzASQDcBIDBSEidva/4bUU60sZo2Ijql1Nc2Ti+l20IRPtrf2HPcq3cQ:tIHBIDBSXdJtsZp1Njl20eb2KQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81
PID 3760 wrote to memory of 2436	3760	74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe	81

C:\Users\Admin\AppData\Local\Temp\74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe
"C:\Users\Admin\AppData\Local\Temp\74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3760
- \??\c:\users\admin\appdata\local\temp\74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe
  "c:\users\admin\appdata\local\temp\74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5.exe"
  2⤵
  PID:2436

memory/2436-132-0x0000000000000000-mapping.dmp

Download
memory/2436-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2436-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download