dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2

Analysis

max time kernel
140s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:51

Target

dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe
Size

324KB
MD5

0fc0d0aee5c2633fef43b31f2bfef116
SHA1

ed180b75303a69ac05d4fc5faeaeac8b1674ead4
SHA256

dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2
SHA512

c1cebb950601f211eb40145c5783dab639b044acb902012486c4a6f15f29c54d90413872fa911e1d3c8b849d6749f839b36a50c72f2e207bdbbb111841750ea9
SSDEEP

6144:wap2pOyKKiamaG+8A0TaKJ8rCw+Wt0dvOgDxcPkCNepRNfGv9:12T5mDlFJJw+WmOgAFolO1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84
PID 1676 wrote to memory of 3604	1676	dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe	84

C:\Users\Admin\AppData\Local\Temp\dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe
"C:\Users\Admin\AppData\Local\Temp\dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe
  "C:\Users\Admin\AppData\Local\Temp\dc431a309748f028a092c85a0d287e6daa6aeb509a6e364007810c5c8831a0c2.exe"
  2⤵
  PID:3604

memory/1676-132-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1676-136-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3604-133-0x0000000000000000-mapping.dmp

Download
memory/3604-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3604-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3604-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download