f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 09:45

Target

f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe
Size

371KB
MD5

34be643784a1e021c71aefed276d536d
SHA1

6d6a751912678140ac19b281c31827e736f2be66
SHA256

f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a
SHA512

ae74a4e4b535693f2c0f3fa94e825b65c0c5acc732a0b01f05f7cb6cd5c4560c3925bf3e1f2be8b5e679a4af1fcc918bbf7f9039141df1bf373265f1afa0eda7
SSDEEP

6144:NkvJm09zORs+z/TMify9DAOngQd0jRXBSG3rneDouhC36W728/:Nsw09CK5NGyTweoEH8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 4460	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	85
PID 2724 wrote to memory of 4460	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	85
PID 2724 wrote to memory of 4460	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	85
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86
PID 2724 wrote to memory of 2116	2724	f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe	86

C:\Users\Admin\AppData\Local\Temp\f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe
"C:\Users\Admin\AppData\Local\Temp\f1c568d99bd9e51db72ad27e8c5d813260cd9426c1ed84b77ba3ff27c37e570a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2116

memory/2116-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download