cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244

Analysis

max time kernel
350s
max time network
423s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:42

Target

cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe
Size

37KB
MD5

f82fa6aecf3e57b48f3e46c152a1b79e
SHA1

30e6a79892504a7ea03ac49693cae4ed60d139a9
SHA256

cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244
SHA512

2a3c0a07da4e2a1d98b86ce68b2ad00496b3642003ac38c55b199455c49539dc7a394c6fd9c972a7860f0c633414a5d7dfb2d047a65202374d9b02a5d7895001
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMy/:edILlknNU4rOobbLyn/

Score

7^/10

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4092	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe
4092	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80
PID 4644 wrote to memory of 4092	4644	cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe	80

C:\Users\Admin\AppData\Local\Temp\cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe
"C:\Users\Admin\AppData\Local\Temp\cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe
  "C:\Users\Admin\AppData\Local\Temp\cf6e69cc3a8bca1212e03301dcfeaf4e86f553636786f2d2cfb9d3ddd8c45244.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

memory/4092-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4092-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4092-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download