78ea6aae2227c96fe1f5e0042be914bc454bbe7756dd57efde6226014d0bc84f

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 22:38

Target

file.exe
Size

393KB
MD5

541f1a758fcc5b6dfb46636d2fe39f32
SHA1

e81c018c49a63b2dd6e4e5f04c2c8c773739f055
SHA256

78ea6aae2227c96fe1f5e0042be914bc454bbe7756dd57efde6226014d0bc84f
SHA512

97c774940ad3baa5a8a76b70d20e9eb8129cd0ab7ae94d715248a02a3b0562735f7feb80ec9b92038f205fc653e1580bf83d391c8066214d21e6cf6d8f467eb4
SSDEEP

6144:SvtjEG2jicP5iOo2T8VrSd/sUAO4klRQechYHjLizs6juUzfHFYvc1aR1Sa:SvtjqiG59ouqkTu6Wzs6ZYvc1u1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 1332	3604	file.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88
PID 3604 wrote to memory of 1332	3604	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1332

memory/1332-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download