d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 04:01

Target

d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe
Size

627KB
MD5

d64a82487bcdcdf93b216c14979d1306
SHA1

36cb2403f023c7c56d2766589a0bf0dae90f9148
SHA256

d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246
SHA512

0696d7bb1f041d163704a9f52d42dd3775341c6713188eaf083e240e4f3fdc8f429a614d48236a97a63e21536250d60afa66ac9f8d9e0e9b01871863d4cde004
SSDEEP

12288:u2N8jiZ4zypIPUtPplTY6RhKuNFUbXuRUbgWaPNArM1V2ryGiLqf0HiVhMf3xDS:u2N8jiZ4zypIPUJTDErbXkUbHaPNAr11

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3296	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe
3296	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89
PID 2612 wrote to memory of 3296	2612	d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe	89

C:\Users\Admin\AppData\Local\Temp\d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe
"C:\Users\Admin\AppData\Local\Temp\d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe
  "C:\Users\Admin\AppData\Local\Temp\d9880865beba3895d3079082b5e59ab582559e1ac49aa21a2588db39132a5246.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

memory/2612-133-0x00000000006A0000-0x0000000000742000-memory.dmp

Filesize
648KB

Download
memory/2612-134-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/2612-135-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/2612-136-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

Filesize
40KB

Download
memory/2612-137-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2612-138-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2612-139-0x00000000068C0000-0x000000000695C000-memory.dmp

Filesize
624KB

Download
memory/3296-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3296-142-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3296-143-0x0000000001AD0000-0x0000000001E1A000-memory.dmp

Filesize
3.3MB

Download