ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 13:37

Target

ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
Size

706KB
MD5

90d13a35138fd4954554855ac8a3c350
SHA1

6fc1d502029e8fe0d6c49b257c1e640bc16eecd5
SHA256

ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc
SHA512

faaaba6836c4cad80914782e94074af9e08b9ca24c70f0ba4115d1845eef73fbc3e36e939ab4a2dde4199b6719a8e77a114f53f97207705d851a02d149dd99a9
SSDEEP

12288:b7UZnP7JZP0+oKbAGxmFlccmFepgu6DLxtOXzd04+uB4Hkrplgen2mUpEE:sZP06Xx1puqLxtaB/lD2mg

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4616	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
4616	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91
PID 892 wrote to memory of 4616	892	ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe	91

C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
"C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe
  "C:\Users\Admin\AppData\Local\Temp\ac9d2adb79875278fa8cd9b6d401abd5a004fb64749fa7f562e666421a894afc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

memory/892-139-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/892-134-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/892-135-0x0000000004FD0000-0x0000000005574000-memory.dmp

Filesize
5.6MB

Download
memory/892-136-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Filesize
584KB

Download
memory/892-137-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/892-138-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Filesize
40KB

Download
memory/892-133-0x0000000000080000-0x0000000000136000-memory.dmp

Filesize
728KB

Download
memory/892-140-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/892-141-0x0000000008C80000-0x0000000008D1C000-memory.dmp

Filesize
624KB

Download
memory/892-144-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4616-142-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4616-145-0x00000000011D0000-0x000000000151A000-memory.dmp

Filesize
3.3MB

Download
memory/4616-146-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download