f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381

Analysis

max time kernel
77s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2023, 20:54

Target

f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe
Size

4.6MB
MD5

41300a51748537519b695c4893f139c4
SHA1

88841e1325894953a2911e18de165e9a214d390a
SHA256

f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381
SHA512

22b208e2c8da8a32637160113c002e84ab36dce70efb2a30ba146e6e2a01a409338cf98be7b00f2d6f76bdefe1c03fc4b623d3ac3ae24ffbabfbb1bd0e021954
SSDEEP

98304:Em2t3fy2VMLFDQ3lp9TgIpQ5cc+ltgm6Jfbn27nv0nm6xQPx:Nb2VMQgYQ0ltgm6ZbXnmf5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3652	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	85
PID 5088 wrote to memory of 3652	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	85
PID 5088 wrote to memory of 3652	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	85
PID 5088 wrote to memory of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86
PID 5088 wrote to memory of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86
PID 5088 wrote to memory of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86
PID 5088 wrote to memory of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86
PID 5088 wrote to memory of 1908	5088	f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe	86

C:\Users\Admin\AppData\Local\Temp\f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe
"C:\Users\Admin\AppData\Local\Temp\f165f1f05acf48b454ed55f01285df0800e6746e04e4d7d69df57ab9e5ce9381.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1908

memory/1908-134-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download