51890ea2e749f0994492bfb2a095f0ddf712b8c91fca65bc606c1ce0021894d8

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 21:35

Target
file.exe
Size 393KB
Sample230918-1fby6sfa72
SHA256 51890ea2e749f0994492bfb2a095f0ddf712b8c91fca65bc606c1ce0021894d8
MD5 9e6d203e150cac859067964318321a22
SHA1 a28b0ab09943f20f05bb72232efa5f415d2e34cd
SHA512 b146dce76eaa9ecf51fab0f70764015fa0a06a5703e2bb7fab59bc1059d486bf45d9dd06cf7e3cef2ac30f5886a32f55a00c5bdeebb09ff6693aab0ce5fbb824
SSDEEP 6144:fefjEL2jicP5iOo2T8VrSd/sUAOJklOQK7BeCkI+WTdvxXByncure9vKb1Sa:fefeqiG59ou/kmxfdJxXB0RiKb1Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 4640	2084	file.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86
PID 2084 wrote to memory of 4640	2084	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4640

memory/4640-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4640-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4640-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4640-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4640-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download