3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e

Analysis

max time kernel
141s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 05:02

Target

3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe
Size

255KB
MD5

3d6788efab38aaa14a24d59c0c790ac0
SHA1

b30c12a67c1d524cb0c8a18a9d59dc533b1b29f9
SHA256

3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e
SHA512

d4c986f5d9391840cf82029928036ea550110f65b48b34107689dddc25abeb250cc2ef300b18858f7fec03508fbdca477266f538eb2b017f2be3d50b64fe027d
SSDEEP

6144:kGKUamZL2dcz7zk6WBQwvnnKnbwyHcxvhN6vw6rLdF:1KLmx2dgPk6oMsxZkvw6b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80
PID 4828 wrote to memory of 728	4828	3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe	80

C:\Users\Admin\AppData\Local\Temp\3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe
"C:\Users\Admin\AppData\Local\Temp\3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4828
- \??\c:\users\admin\appdata\local\temp\3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe
  "c:\users\admin\appdata\local\temp\3abafd2d348fdc81ba618ff7aa9340f180b6de7dffd319bb5780c5494627611e.exe"
  2⤵
  PID:728

memory/728-132-0x0000000000000000-mapping.dmp

Download
memory/728-133-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/728-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download