ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e

Analysis

max time kernel
103s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:12

Target

ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe
Size

110KB
MD5

3b583c9f616ebe0bf1bdb31c45cce2d3
SHA1

2060532701285b62ed897afa7558ec4575e8f01f
SHA256

ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e
SHA512

c7a59949bad248f815ec3919f3aae44e9b0920fae24e617164124b564aecd78aba672b2de5d5256a8af78612aa2cae02172ebfc5af875a72db3509aa7e6a850d
SSDEEP

1536:dTKdhmMFi+lokn0CcuQpuv0Ix0vkHWR8ceQDxeOk:dT8cUi20DuQpKnsMkrBk

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79
PID 4976 wrote to memory of 4332	4976	ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe	79

C:\Users\Admin\AppData\Local\Temp\ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe
"C:\Users\Admin\AppData\Local\Temp\ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe
  "C:\Users\Admin\AppData\Local\Temp\ad3a51a9582304c3fa5c342ed215c9bf45c252145cc069f43c454c5a200a044e.exe"
  2⤵
  PID:4332

memory/4332-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4332-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4332-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download