e0a25f64e0f24c31473db83ef9148f710563883ba2fece515f4e3f11e1514988

Analysis

max time kernel
134s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 18:39

Target
569ae4605a3a9cf9614aa78fdb2330f0.exe
Size 642KB
Sample230214-xamlyafd32
SHA256 e0a25f64e0f24c31473db83ef9148f710563883ba2fece515f4e3f11e1514988
MD5 569ae4605a3a9cf9614aa78fdb2330f0
SHA1 b66801f2b5ae5421ecea109c72e155aa11703ad1
SHA512 5eb4650ab8885e740132051f56dd82535e6fa9b90d718bff58d2e17f40006778ca5ebbb4633b66cdfed547a372788f9dc0f1f164f14dae122b7bcd3c9d3a7519
SSDEEP 12288:wfecesRD0DnOcIA/9L4isLeWSVR6D9o+OvwBQqvo:BcesR8wS4isqf+a+OvwBQqg
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	569ae4605a3a9cf9614aa78fdb2330f0.exe
3624	569ae4605a3a9cf9614aa78fdb2330f0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88
PID 1284 wrote to memory of 3624	1284	569ae4605a3a9cf9614aa78fdb2330f0.exe	88

C:\Users\Admin\AppData\Local\Temp\569ae4605a3a9cf9614aa78fdb2330f0.exe
"C:\Users\Admin\AppData\Local\Temp\569ae4605a3a9cf9614aa78fdb2330f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\569ae4605a3a9cf9614aa78fdb2330f0.exe
  "C:\Users\Admin\AppData\Local\Temp\569ae4605a3a9cf9614aa78fdb2330f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624

memory/1284-132-0x0000000000760000-0x0000000000806000-memory.dmp

Download

memory/1284-133-0x0000000005630000-0x0000000005BD4000-memory.dmp

Download

memory/1284-134-0x0000000005120000-0x00000000051B2000-memory.dmp

Download

memory/1284-135-0x0000000005090000-0x000000000509A000-memory.dmp

Download

memory/1284-136-0x0000000005350000-0x00000000053EC000-memory.dmp

Download

memory/3624-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3624-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3624-140-0x0000000001460000-0x00000000017AA000-memory.dmp

Download