ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c

Analysis

max time kernel
161s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:14

Target

ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
Size

333KB
MD5

47317c35b065f6b2a483fc0115aff9cc
SHA1

aed6337b6048f1ae37d5922b24e98ed91e8f9cb8
SHA256

ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c
SHA512

f3ff79bdf29086a60eab22c0b1a1537b84033afc9c55587caf6e088c34694288272386cd624885be1cce446d04048dff33da0230c7319b17892604a01d80fcdc
SSDEEP

6144:Ff88r7YXAL5PCv5zVr8KyTX5kCY00X4XkQK35GA2z:Ff88oXyav9yKHA6QAs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3120 set thread context of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79
PID 3120 wrote to memory of 4968	3120	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	79

C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
"C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
  "C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe"
  2⤵
  PID:4968

memory/3120-132-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3120-136-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4968-134-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4968-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download