46cbe5d6e42f3fe2f33ce0643ddfa1f9b28e58a38df8e351f5691e7f347befd2

Analysis

max time kernel
127s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 02:05

Target
file.exe
Size 371KB
Sample230918-chvbjagf78
SHA256 46cbe5d6e42f3fe2f33ce0643ddfa1f9b28e58a38df8e351f5691e7f347befd2
MD5 b271eb1cdd6c4db3541a5eb445c78a55
SHA1 c051b2e7f085398454ef7ab397414f80061ab619
SHA512 92e3ef52548b7c66dc381467381e49fb8619a0c5df6f7b081bf09e5c7069a8121438769b8f9c98affd95486436049bd77bbb59b3da2b6123403e5c5d534ebacf
SSDEEP 6144:UGvJm09zORs+z/TMify9DAOwgQFWq/5NsSzBeUGAvaJ0UMFLJtmvqnnn7YmM8/:Uuw09CK5NvqX/5NsSzQcaJPkLJIEM8/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4928 set thread context of 2680	4928	file.exe	87

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87
PID 4928 wrote to memory of 2680	4928	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2680

memory/2680-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2680-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2680-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2680-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2680-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download