2f27999bebf5c5bf006a65fcc05db4d7f43d81599d3c7d92ddbf98f91afff048

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 03:59

Target
file.exe
Size 393KB
Sample230919-ej3emsgg76
SHA256 2f27999bebf5c5bf006a65fcc05db4d7f43d81599d3c7d92ddbf98f91afff048
MD5 2927f2a7e83c005cfd9171e7cc62ee4a
SHA1 737e30e56666cd9f6f5475bab1edceb9e2654183
SHA512 c060c208ca385892ed83f0409fd9df70cc522fa438bc7146a9ec0df5f485e477f8c2194604240930bcc1e057dae37b7e43083143ccad4f8c4dee92af53372911
SSDEEP 6144:TSyjE12jicP5iOo2T8VrSd/sUAOBklaUAHTVSoiKES9qVNc7GU781Sa:TSyYqiG59oujkAtHTERKzqVNc7nA1Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 2988	664	file.exe	85

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85
PID 664 wrote to memory of 2988	664	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2988

memory/2988-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2988-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2988-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2988-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2988-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download