e88f353f80921e0c08a07ff6b21a2b49e76f725b64091882f195ad2188bfed7d

Analysis

max time kernel
183s
max time network
249s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 06:51

Target

k6410515.exe
Size

371KB
MD5

6804acbd44a5ab4c608fdb92341183ee
SHA1

acb81d6f72ec55d985ab931d377b512c51f04f60
SHA256

e88f353f80921e0c08a07ff6b21a2b49e76f725b64091882f195ad2188bfed7d
SHA512

7613220aae6ee741c3db4b576bf9b5c25b47ca45d96096161b72b99e02535d4c4d94e2fab6c9e2e37555d771338536a89862e5ec527cac4e61ab314378184123
SSDEEP

6144:PYvJm09zORs+z/TMify9DAOxgQPqrgJA0Tdm2SSTkZ7vMQiEg8/:Pow09CK5NclUJA05m7KAvMlt8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4484 set thread context of 4988	4484	k6410515.exe	71

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 984	4484	k6410515.exe	70
PID 4484 wrote to memory of 984	4484	k6410515.exe	70
PID 4484 wrote to memory of 984	4484	k6410515.exe	70
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71
PID 4484 wrote to memory of 4988	4484	k6410515.exe	71

C:\Users\Admin\AppData\Local\Temp\k6410515.exe
"C:\Users\Admin\AppData\Local\Temp\k6410515.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4988

memory/4988-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4988-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4988-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4988-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4988-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download