bb1e9e2aefec951f75ef364008604f22baca18e51c8acbd599462a406a23599b

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 04:41

Target
file.exe
Size 393KB
Sample230919-fa4f1sgh85
SHA256 bb1e9e2aefec951f75ef364008604f22baca18e51c8acbd599462a406a23599b
MD5 ff7c3a250405dd7f86ab062577181c2f
SHA1 7ae57557eae234e8a39971ac774831e9868b4072
SHA512 7deed8d996c4162faf6aac0b575ebda42183300474b35b8ddb87b9e1be7a013cd4035432761ded6ed68744e733d88cf465dee24ad0fe55a3fac3f75e1d120b2e
SSDEEP 6144:sCSjEX2jicP5iOo2T8VrSd/sUAOCkliIsonigV1vG6X4KdsIulA4k1Sa:sCSGqiG59ouQkoIv1V1+q4KdVWA11Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 1200	228	file.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86
PID 228 wrote to memory of 1200	228	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1200

memory/1200-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1200-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1200-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1200-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1200-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download