1f1b8f4b7f148de3f489277914f06ba6228fb7bea8ef497cb75c2144e4e2b28b

Resubmissions

21-09-2023 07:12

19-09-2023 06:52

max time kernel
270s
max time network
278s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:52

Target

k8684673.exe
Size

371KB
MD5

92d7903295eeca59b8ccd1f6299eda7b
SHA1

4555db3293cc8498017b58eb6fd5fabc0073f94e
SHA256

1f1b8f4b7f148de3f489277914f06ba6228fb7bea8ef497cb75c2144e4e2b28b
SHA512

5c5ba099e60a15b4339b214f83f68faaceddfc91b67f89295899233d4b10e1d74cde2a6e9bd81a8a20c3857eed6ad0c7e52a98dede8768ba8d7d6abf172ff29a
SSDEEP

6144:YwvJm09zORs+z/TMify9DAOUgQls0fqfmZ0kfMFX3aBsNYWNNWL+TI8eIttm8/:Ygw09CK5NTgs/xRjNYWNG+/eIi8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k8684673.exe

description pid process target process

PID 4172 set thread context of 2732 4172 k8684673.exe AppLaunch.exe

description	pid	process	target process
PID 4172 set thread context of 2732	4172	k8684673.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

k8684673.exe

description	pid	process	target process
PID 4172 wrote to memory of 2824	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2824	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2824	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe
PID 4172 wrote to memory of 2732	4172	k8684673.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2732

memory/2732-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2732-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2732-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2732-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2732-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download