987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 12:23

Target

987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe
Size

836KB
MD5

7210e586178e2a144a8f38e1d0814573
SHA1

2bbbeb65af7089f73bb5974941d2ca877d19ce28
SHA256

987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a
SHA512

637107bf38ef33a5863015f20fee825bb5861319e05784e7ca09eb1f6ee81d4b74142602df1f626caa798f369f0a0b192ddcfaf693f0d87b4aeba16376e26f61
SSDEEP

24576:z8QB+UZGELUTYB7T01XxBolcs/IGjqTxBvq:YQBhZVU8B7iBo3beTny

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe
4704	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106
PID 2248 wrote to memory of 4704	2248	987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe	106

C:\Users\Admin\AppData\Local\Temp\987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe
"C:\Users\Admin\AppData\Local\Temp\987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe
  "C:\Users\Admin\AppData\Local\Temp\987f477e626f57c4ba440be3016995b5b9d7365a422c0a1d9be524e4993def8a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704

memory/2248-133-0x00000000006C0000-0x0000000000798000-memory.dmp

Filesize
864KB

Download
memory/2248-134-0x00000000056F0000-0x0000000005C94000-memory.dmp

Filesize
5.6MB

Download
memory/2248-135-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/2248-136-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/2248-137-0x0000000005140000-0x000000000514A000-memory.dmp

Filesize
40KB

Download
memory/2248-138-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/2248-139-0x0000000006D70000-0x0000000006E0C000-memory.dmp

Filesize
624KB

Download
memory/4704-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4704-142-0x0000000001750000-0x0000000001A9A000-memory.dmp

Filesize
3.3MB

Download
memory/4704-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download