6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b

Analysis

max time kernel
197s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:45

Target

6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
Size

80KB
MD5

5c84a441fed69b37bcf9dbe76c3e847d
SHA1

673db7eab5293911628e46ad8991e22c8663007e
SHA256

6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b
SHA512

e1f20d91d5acd65e712b1d0b3273f9dc3fe67ce113a3d8c325c907efec846b39636aa12c90f9596702a7ef269cb30c35004a03b84d5fdc1e28a9b6640abf2715
SSDEEP

1536:YExpgxDvBaKo3MQH6qpI9JkUXGdsr8SrU5ZEggyDyYzgiJ/:wV68QHRWfkEmsrxrU5ZEiuYzl/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79
PID 2900 wrote to memory of 5056	2900	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	79

C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
"C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
  C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
  2⤵
  PID:5056

memory/5056-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5056-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5056-137-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/5056-138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download