5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 04:44

Target

5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe
Size

255KB
MD5

fac0458d0601fd6bc691d3e591f0641c
SHA1

c9f3941ac2d186bd4609008c35539b9275c067be
SHA256

5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468
SHA512

188a3b8bb2a37da69d0899ad3bd1ce4641fa8a107090e29d883418978648503924ea3ed02d85693908fedd48f50954dcea9707db7b0a96fef65bd56ddb907fcc
SSDEEP

6144:rnvY7rPM4hycqKCp8GdX1KQ6Vh0EVI0KOlhzqm//J7JLX7qG:rnA7pcp8ClKZQEOixz/JtD7q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81
PID 1692 wrote to memory of 444	1692	5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe	81

C:\Users\Admin\AppData\Local\Temp\5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe
"C:\Users\Admin\AppData\Local\Temp\5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- \??\c:\users\admin\appdata\local\temp\5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe
  "c:\users\admin\appdata\local\temp\5ca426bddd436acb097853063f72fe5226f64c2cdeacb8ddd083ef896bb69468.exe"
  2⤵
  PID:444

memory/444-132-0x0000000000000000-mapping.dmp

Download
memory/444-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/444-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download