74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f

Analysis

max time kernel
193s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 03:10

Target

74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe
Size

322KB
MD5

6c78a972994cc61b642f870ff9239c28
SHA1

67e15a2e9084165b5dee5d3a31abb35a01d6a3ce
SHA256

74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f
SHA512

4ce2e245a9388d6dab824874edc61a6fa8d2b6758b26810d6b1852fb71ed4109a99d8b530cd3dfb5db83eaccdda9bf80c5e344203f9d3649b6ef22ee6ce6539c
SSDEEP

6144:VJgJqLRdtwj7Cx9CfmXyKN3Or7PigcAkfTGHsOE9G/2yEuaIrouctmz:3SyRw+9CfmXyKBOXYAwTXO0zuaIrour

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3300 set thread context of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83
PID 3300 wrote to memory of 4648	3300	74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe	83

C:\Users\Admin\AppData\Local\Temp\74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe
"C:\Users\Admin\AppData\Local\Temp\74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe
  "C:\Users\Admin\AppData\Local\Temp\74ee5c3d4522602d2537d902875d706cda37fdfc41b53a4e20e494d5b3f6504f.exe"
  2⤵
  PID:4648

memory/3300-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3300-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4648-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4648-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4648-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download