5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8

Analysis

max time kernel
128s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 11:12

Target

5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe
Size

1003KB
MD5

949a56401d66cb35a043a3b89652d7e8
SHA1

72c00d769b8a610ef9e508cdc9caf4c1652b06f5
SHA256

5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8
SHA512

9ae7db3bc82637e92bff4aa8d5858bf724b8783827877c3c3343d9c1c13f5772accf0e5e6a391609f96ca5420abc535196a70e0cd6d0da6e76dd6b1e379aa784
SSDEEP

24576:0OyqGUL8dX6zTwayLvWW79nnv0DPeq+8my:0NqGo8dXKTwlLeW79n7q+8my

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3212 set thread context of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe
3328	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86
PID 3212 wrote to memory of 3328	3212	5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe	86

C:\Users\Admin\AppData\Local\Temp\5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe
"C:\Users\Admin\AppData\Local\Temp\5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe
  "C:\Users\Admin\AppData\Local\Temp\5fb31e60567d6a71966f7232cc9836835ad962bc588960a54c3f5a2f30f49de8.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

memory/3212-133-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download
memory/3212-134-0x0000000005930000-0x0000000005ED4000-memory.dmp

Filesize
5.6MB

Download
memory/3212-135-0x0000000005380000-0x0000000005412000-memory.dmp

Filesize
584KB

Download
memory/3212-136-0x0000000005330000-0x000000000533A000-memory.dmp

Filesize
40KB

Download
memory/3212-137-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3212-138-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3212-139-0x0000000006C80000-0x0000000006D1C000-memory.dmp

Filesize
624KB

Download
memory/3328-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3328-142-0x0000000001A60000-0x0000000001DAA000-memory.dmp

Filesize
3.3MB

Download
memory/3328-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download