868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221

Analysis

max time kernel
187s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 18:10

Target

868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe
Size

280KB
MD5

973263d4e6f2ea9e009e247db916b820
SHA1

2fd8a15c4e4ed6c6d19bd9303b07f513efdc157c
SHA256

868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221
SHA512

83017690df5fc91c5591abe03d10d5f8027ef536e423a48e85e291dd48a7ffa74099119598f5dd09f09ab7f19457a53818239f47489f2a67aefa7ca5e019c34e
SSDEEP

6144:wl666666zJ7wj51kynAaE8RarkR8O68cCQLzAeqyQnrf1:g666666zJ7KkyHOkR7cnAnPrf1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83
PID 308 wrote to memory of 4400	308	868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe	83

C:\Users\Admin\AppData\Local\Temp\868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe
"C:\Users\Admin\AppData\Local\Temp\868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe
  "C:\Users\Admin\AppData\Local\Temp\868fd1881686d2073b6cd6f479be0b33cd5868f9519f9d3683bd61d18c85a221.exe"
  2⤵
  PID:4400

memory/308-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/308-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4400-134-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4400-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download