bdefdcbdd5af76934913cdfc76ac1785f6df8a5fe32d36e1fbabcf8de754867a

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 03:12

Target
file.exe
Size 393KB
Sample230919-dp6tksee4y
SHA256 bdefdcbdd5af76934913cdfc76ac1785f6df8a5fe32d36e1fbabcf8de754867a
MD5 be36bdd314d0625a1187a2405f8a359f
SHA1 922c44b9735ae340c17c946680a2020124a5dc40
SHA512 b55dbabdad4786d87ab17aa8a86a2ab71b1a15fe5d44665f2903550d0296722e56b2694dd57fc0f09b3012e42c7bc8a3e89b92f35fc283a31282f8e907c439f6
SSDEEP 6144:U2QjEf2jicP5iOo2T8VrSd/sUAOqklYQ4Fai/TsLVnpeNVBjqx9sA5n1Sa:U2QKqiG59ouYkZAaibA1x1Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 2304	2716	file.exe	87

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2216	2716	file.exe	86
PID 2716 wrote to memory of 2216	2716	file.exe	86
PID 2716 wrote to memory of 2216	2716	file.exe	86
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87
PID 2716 wrote to memory of 2304	2716	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2304

memory/2304-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2304-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2304-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2304-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2304-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download