c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4

Resubmissions

30/08/2023, 23:51

29/08/2023, 18:38

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 18:38

Target

c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
Size

664KB
MD5

04bcbc084757b3dc87cdc158372207d8
SHA1

0eae3faac86b067e268f95313bd9c651a2187c64
SHA256

c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4
SHA512

e6de6a50253d986c4e76fb42935a2268d1a1c6811df7e66544267c24138ee43f56ce2b45c9aa0e24ec57afe5f5128cc1288a2f2d38603fa93cfd26a39ca8487d
SSDEEP

12288:uJdoCUhRcOJ5cY7Jg9oC9f0viSM/vb/F0weXFEUFFDeP69cu6lDy:uf5yP29oviSM/v7eDeF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
2872	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92
PID 1780 wrote to memory of 2872	1780	c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe	92

C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
"C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe
  "C:\Users\Admin\AppData\Local\Temp\c0545f16fbbecef4ff1983c05e620651f24c48d3debaf525fd3e057ef688fae4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872

memory/1780-6-0x00000000054B0000-0x000000000554C000-memory.dmp

Filesize
624KB

Download
memory/1780-1-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/1780-2-0x00000000056C0000-0x0000000005C64000-memory.dmp

Filesize
5.6MB

Download
memory/1780-3-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/1780-4-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/1780-5-0x0000000005380000-0x000000000538A000-memory.dmp

Filesize
40KB

Download
memory/1780-0-0x0000000000740000-0x00000000007EA000-memory.dmp

Filesize
680KB

Download
memory/1780-7-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/1780-8-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/1780-11-0x0000000074560000-0x0000000074D10000-memory.dmp

Filesize
7.7MB

Download
memory/2872-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2872-12-0x00000000010C0000-0x000000000140A000-memory.dmp

Filesize
3.3MB

Download
memory/2872-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download