35f109d6c67a0f2fcc7b32cccf754079e682a423f44bdc1019094637080202e9

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 07:13

Target

file.exe
Size

393KB
MD5

dcf100f3cd279386734be0b6953cd771
SHA1

97ac468b9fb891181fee3007166683926a5dd436
SHA256

35f109d6c67a0f2fcc7b32cccf754079e682a423f44bdc1019094637080202e9
SHA512

b7ef05b404b6144c2ed84c80344faa869b787ba197a331dd94d42555b0f9864f2d4f77f3faeef7e976a53b429d74ec6991c492e403c845191fc011205e2e4109
SSDEEP

12288:ViC6qiG59ouZkHEC7VD1Su+40BnOr1Sa:ViCN5EEC79+4Yncs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4124 set thread context of 3708	4124	file.exe	89

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4280	4124	file.exe	86
PID 4124 wrote to memory of 4280	4124	file.exe	86
PID 4124 wrote to memory of 4280	4124	file.exe	86
PID 4124 wrote to memory of 1120	4124	file.exe	87
PID 4124 wrote to memory of 1120	4124	file.exe	87
PID 4124 wrote to memory of 1120	4124	file.exe	87
PID 4124 wrote to memory of 1148	4124	file.exe	88
PID 4124 wrote to memory of 1148	4124	file.exe	88
PID 4124 wrote to memory of 1148	4124	file.exe	88
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89
PID 4124 wrote to memory of 3708	4124	file.exe	89

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3708

memory/3708-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3708-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3708-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3708-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3708-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download