3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af

Analysis

max time kernel
69s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:26

Target

3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe
Size

249KB
MD5

21d3a298c79dfffaaed4b58a5e26d620
SHA1

ad3f9a34baba30237fefe12354fe740f8721f08b
SHA256

3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af
SHA512

d273256862b223935e9249f89390e2164f1ebaaa75606d2cc7fbde0ff4d074135cefe4e1a1c743448e104acc0a935b215c848eba9f72c5e82369e3ec6945755d
SSDEEP

3072:aDovmVVTVhWxJ0pUkkbKZfG+c9zf0j70ZjsGTOm1jZLEnUMDS2jbxWGq6p:EzVHhz6kkyi9zgwqRvUMDSbGq

Score

5^/10

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 380	3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe	81
PID 3952 set thread context of 380	3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe	81

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 380	3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe	81
PID 3952 wrote to memory of 380	3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe	81
PID 3952 wrote to memory of 380	3952	3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe	81

C:\Users\Admin\AppData\Local\Temp\3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe
"C:\Users\Admin\AppData\Local\Temp\3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe
  "C:\Users\Admin\AppData\Local\Temp\3f6f2f6a6c5867031f8480fd8df6ee2161459d19f1579d96c6fc6bbf73c482af.exe"
  2⤵
  PID:380