2f9aadf04977d5ec167ab8634c7d5c53c115880d1b8084b199c353148025864d

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2023, 17:35

Target

file.exe
Size

371KB
MD5

94cf9634c3557b08eabb0e85310cebb2
SHA1

665e12c79c2af3fdb26f73d6e5dd49fc36c12236
SHA256

2f9aadf04977d5ec167ab8634c7d5c53c115880d1b8084b199c353148025864d
SHA512

3dbc043f0a2ddbd3e4bcbf63fa5240e9379330d33f8b358e0ab86f8546fc20b1b52caa9571628abffc35d35a153f754c39f9b8d62e7ba40f2992c233296a73f0
SSDEEP

6144:VwvJm09zORs+z/TMify9DAOPgQoDasDQkxpDR8JIw8/:Vgw09CK5N+1DasDQkxpDR8P8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 4252	4228	file.exe	79

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79
PID 4228 wrote to memory of 4252	4228	file.exe	79

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4252

memory/4252-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4252-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4252-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4252-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4252-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download