b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169

Analysis

max time kernel
158s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 19:06

Target

b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
Size

209KB
MD5

6eb637c09a950bed99fe187ec68a44c9
SHA1

383cbfdbdfb88a62fcb993a9b66dbab4516a66b8
SHA256

b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169
SHA512

d8514ee6e27060ef46d7bb325eb122e9e28bc05cf64637a17319836a5f23328e4e2777a534123167f6dc7af4998153d689f696b8d116d868b2a13caa3c6297e8
SSDEEP

3072:/yAkWQBc70vZLdR5jZCFNtGJwxgH2koSEAhguxc3O7cp9Zn6+U/Lqx9b:/sJBc+Zv5j1Oe9oehPxWrZ6+CI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78
PID 3276 wrote to memory of 3784	3276	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	78

C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
"C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
  "C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe"
  2⤵
  PID:3784

memory/3784-132-0x0000000000000000-mapping.dmp

Download
memory/3784-133-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3784-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3784-136-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download