6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0

Analysis

max time kernel
102s
max time network
107s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
18/09/2023, 18:40

Target

6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe
Size

365KB
MD5

3d6532b3aec9fea0ba890035519d6730
SHA1

82c0d07cb5dbbe1492462c259f3ef070e3862ae1
SHA256

6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0
SHA512

082b5b2d9a3f37c31486455b9e3138174a5fae81f9530cc89c60f44d378fe2d76b660e7cd13ec183444f6b0311dd90b500c808c5f82c75f79a9f7890554a35ca
SSDEEP

6144:fEKjEh2jicP5iOo2T8VrSd/sUAOpUllAlVJ0paqzFfO7c21Sa:fEKsqiG59ouvUUlK3Ow21Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3916	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	71
PID 4988 wrote to memory of 3916	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	71
PID 4988 wrote to memory of 3916	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	71
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72
PID 4988 wrote to memory of 4524	4988	6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe	72

C:\Users\Admin\AppData\Local\Temp\6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe
"C:\Users\Admin\AppData\Local\Temp\6afc88a24bcc3dd9bd0e240ce3950e1b521a606d78c709ce171158ae5e75f4f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4524

memory/4524-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4524-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4524-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4524-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4524-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download