c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3

Analysis

max time kernel
158s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 05:56

Target

c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe
Size

24KB
MD5

aee9403441042f254363031613f78de4
SHA1

746e94b2ddbe75343782fa856bb5943d1550ac4f
SHA256

c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3
SHA512

32bcf239fae928563284ee7ef93a2c6ae0cf075b7708506f13e79b539b05d5d073145a3f0b17422cdf587d04418b053bcb9e7a2c289cdf0101c8f0dd8f27c8ca
SSDEEP

384:V/e1c9f9lhcq1xtVMZYcZcHeNDWMJJMzU5U8po5Tt8KS07b2FqoQjKE4azld5:gufzJ1xtVMq4XDW0JtWfS0AiDB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79
PID 1656 wrote to memory of 1868	1656	c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe	79

C:\Users\Admin\AppData\Local\Temp\c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe
"C:\Users\Admin\AppData\Local\Temp\c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe
  C:\Users\Admin\AppData\Local\Temp\c0097e1b6082787f9a924ca71366000391f9636e2be31f8c22c3ca879c8dcac3.exe
  2⤵
  PID:1868

memory/1868-132-0x0000000000000000-mapping.dmp

Download
memory/1868-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1868-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1868-136-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download