831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:13

Target

831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
Size

71KB
MD5

ff0ce7f9ce4f7d29b61d1c9c21438609
SHA1

37e5c230571f12f774b2f584a4741967c615d6de
SHA256

831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81
SHA512

18f8e0c82904551c3040ecafea7ad4a1acae2a1e8075a27642a950b248287b863d61f69a7b13cfa9cad13f394d65c5859484b15c7940c171b04844b3737d412a
SSDEEP

1536:KKMonowh4ostPr2/kBmkWbpab+CtuMFxdWOo6CLvjs8wBjnv:Knonoros9Pkbpe+zOo6EwBjnv

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5076	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
5076	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79
PID 2476 wrote to memory of 5076	2476	831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe	79

C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
"C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe
  "C:\Users\Admin\AppData\Local\Temp\831c4b63b18e6cbd1ff923572172e3517050ea187041d99c727430ee648bca81.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

memory/5076-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5076-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5076-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download