9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:40

Target

9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe
Size

322KB
MD5

d5d3abf7f6bf92c36a27657b957f1eda
SHA1

00bdb05ae85f15573168ae2b5c0ea17fc5f65ef3
SHA256

9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb
SHA512

aa8ee7077f9a6f0950d684ce2f6e6fe2f42987c3f065ecb66ebceb81dbc26127011476b958c8a7602302fc874452f25703752c4322112e9a8de1973e59a0b6bc
SSDEEP

6144:f5ADU35zeQ0R7+28O86sgg/QNpZmoZkdkCVLeC2wuJv8200XRRvD+S6GbEJXuh4X:xEa5zeD7+q/mIkdUvV0qRRL76zj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80
PID 4972 wrote to memory of 2236	4972	9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe	80

C:\Users\Admin\AppData\Local\Temp\9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe
"C:\Users\Admin\AppData\Local\Temp\9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe
  "C:\Users\Admin\AppData\Local\Temp\9a1e0ec6ca0fbf49384efdb8be759378841602e554ba0528df1de9f8693081eb.exe"
  2⤵
  PID:2236

memory/2236-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2236-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2236-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4972-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4972-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download