4df6bfd0831c63681da55ff22d4c6c97194ff02ced1414668a7bb13dfbeea980

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 04:49

Target
8c56eb64555127541e802044febab8cc.exe
Size 706KB
Sample230209-ffnyhscf5s
SHA256 4df6bfd0831c63681da55ff22d4c6c97194ff02ced1414668a7bb13dfbeea980
MD5 8c56eb64555127541e802044febab8cc
SHA1 91a328c71ae281cc53782c40cdfc4624767555df
SHA512 10d061cf059458f5128396ea474b94517f4f200db3e769a9c38da497a076e2b3f3d446d42302da1009c00f253897b43153934412dbf76cf38d6a318d7bbde5a3
SSDEEP 12288:ZGARa3GUecJp1tDX2mRg5xIBGNQ5kt3hrks8RFmUXe1KaI0Yt8tpy/QlQX:ZTPUeFmRg59Qc3hY9bXqJI0B6QlQX
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3808	8c56eb64555127541e802044febab8cc.exe
3808	8c56eb64555127541e802044febab8cc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83
PID 3564 wrote to memory of 3808	3564	8c56eb64555127541e802044febab8cc.exe	83

C:\Users\Admin\AppData\Local\Temp\8c56eb64555127541e802044febab8cc.exe
"C:\Users\Admin\AppData\Local\Temp\8c56eb64555127541e802044febab8cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\8c56eb64555127541e802044febab8cc.exe
  "C:\Users\Admin\AppData\Local\Temp\8c56eb64555127541e802044febab8cc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

memory/3564-132-0x0000000000E50000-0x0000000000F06000-memory.dmp

Download

memory/3564-133-0x0000000005D60000-0x0000000006304000-memory.dmp

Download

memory/3564-134-0x00000000057B0000-0x0000000005842000-memory.dmp

Download

memory/3564-135-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/3564-136-0x0000000009550000-0x00000000095EC000-memory.dmp

Download

memory/3808-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3808-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3808-140-0x0000000001030000-0x000000000137A000-memory.dmp

Download