b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:07

Target

b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe
Size

321KB
MD5

abd589415d2b027dc6d4b59bab94af10
SHA1

4bf4afe4d488bb3787d2218ec436dd27fcaac76a
SHA256

b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc
SHA512

adb189f3aa1b009f37d1b4f08da4274ec55be12a7180a51d9ae6611c3d80ceeb94e6b7bdf49d6b39f9552ac456d6343ad26dd20b39b3e6fe75f0dfdc901806e7
SSDEEP

6144:NdroYrj6mMQqxsFcCsOTNxyfcm/Mr5ftGEus+ZSxyaFmdVu54voSVnXW:2wq6FcCJTKZ/DEzFwW4voSpW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4936 set thread context of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81
PID 4936 wrote to memory of 4808	4936	b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe	81

C:\Users\Admin\AppData\Local\Temp\b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe
"C:\Users\Admin\AppData\Local\Temp\b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Temp\b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe
  "C:\Users\Admin\AppData\Local\Temp\b243b36c76f9c504dcc40fe79e65c9ff2c153102dc56101f08fd7acf98573abc.exe"
  2⤵
  PID:4808

memory/4808-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4808-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4808-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4808-138-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4936-132-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4936-136-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download