d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858

Analysis

max time kernel
115s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 05:13

Target

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
Size

517KB
MD5

9eb9ce6fa80e866fccb277b400033685
SHA1

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8
SHA256

d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858
SHA512

16bea65d58a3f968110411b067ea7cbdb4cab5ebd1edbf9d94428fed1bc0e40741c799b0c4d6ddd9de3e87f18322416924f03478a6041f8566f64f7bded9e760
SSDEEP

12288:Eg8tD+p1h79i/DdVedE5fJD7uwkIPveEosOgGSgSkrcq3qilOL:EgwVDdcE5fJheEovgYSkwq3qis

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

description	pid	process	target process
PID 2920 set thread context of 3196	2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

pid process

3196 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
3196 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

pid process

2920 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
2920 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

pid	process
3196	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
3196	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

pid	process
2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

description	pid	process	target process
PID 2920 wrote to memory of 3196	2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
PID 2920 wrote to memory of 3196	2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
PID 2920 wrote to memory of 3196	2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
PID 2920 wrote to memory of 3196	2920	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe	4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe

C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
"C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196

memory/3196-132-0x0000000000000000-mapping.dmp

Download
memory/3196-133-0x0000000000DC0000-0x000000000110A000-memory.dmp

Filesize
3.3MB

Download