dde1c6c362953397b5b698c2b389b39e638473a1190e54ce03575fde39f244ab

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 12:14

Target

file.exe
Size

371KB
MD5

d18372a9bed95a143ea42554ef5d743a
SHA1

e36a5c64b49e40481a6c5bb80c37a006b1a12a0a
SHA256

dde1c6c362953397b5b698c2b389b39e638473a1190e54ce03575fde39f244ab
SHA512

98f78553c5b6e44655700f4979752a88e0b7506a2d6c9a72ba3d00b12b22c3fa6c92dac4dc0741bfc59cc4a2ba685b5857a31d765d18846ac07f90f2a5f63f26
SSDEEP

6144:q0vJm09zORs+z/TMify9DAOugQa6WRYGsLecJCxm+vEp6ELp6wpH8/:qcw09CK5NBT6+YMcMDv1u6o8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3496 set thread context of 3880	3496	file.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86
PID 3496 wrote to memory of 3880	3496	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3880

memory/3880-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3880-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3880-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3880-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3880-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download