418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2023 22:54

Target

418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe
Size

371KB
MD5

ba57b45a3450a71eafb0c9838b03edbf
SHA1

a2eb43fc9fc563857e4710701ec9ae2e5f9faa39
SHA256

418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c
SHA512

3173e012786ad1d0e570a22a534ff98f3c5e1d86d140fb18cee65f6592df246a39531ed0796bb1973cf2c45f35c46df65e6c9c756d66ea2b9e1676150d399b8a
SSDEEP

6144:ybvJm09zORs+z/TMify9DAO6gQZg+srZGomX74Yu1dUqjknHSpOGj7s8/:y7w09CK5N5Tf7StUdVprg8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87
PID 4284 wrote to memory of 2100	4284	418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe	87

C:\Users\Admin\AppData\Local\Temp\418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe
"C:\Users\Admin\AppData\Local\Temp\418ae7a702d6689ae0a30344071c021eb2f153e5c5ee4a49b51a65c72356c66c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2100

memory/2100-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2100-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2100-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2100-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2100-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download