5b5bbabb4c3ef9f465d1e8f2cf54cb097a3756b307b859cd0bf80691a618ead9

Analysis

max time kernel
252s
max time network
285s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 06:51

Target

k6689391.exe
Size

365KB
MD5

e3ea9776a8e23908e4fea6b03ed2fcc2
SHA1

11c90547ffe26b7e467c9447f5d7d5318aecc8d7
SHA256

5b5bbabb4c3ef9f465d1e8f2cf54cb097a3756b307b859cd0bf80691a618ead9
SHA512

7614da4d3d4a4fa3139a93da160f7f60a6aa331762edb35d6977f8e2a230be650c3a1c388de9997eb0dcc4e3ac0764ecbb8a173710dd392c69391e024e8cac58
SSDEEP

6144:PuejEA2jicP5iOo2T8VrSd/sUAOFUlHOehHOQDgLgsLsTJHYDvZcTYnNgzzlyAu5:PuetqiG59oufUttfgL/L2J/T3yAufx11

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3148 set thread context of 1336	3148	k6689391.exe	73

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 164	3148	k6689391.exe	71
PID 3148 wrote to memory of 164	3148	k6689391.exe	71
PID 3148 wrote to memory of 164	3148	k6689391.exe	71
PID 3148 wrote to memory of 352	3148	k6689391.exe	72
PID 3148 wrote to memory of 352	3148	k6689391.exe	72
PID 3148 wrote to memory of 352	3148	k6689391.exe	72
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73
PID 3148 wrote to memory of 1336	3148	k6689391.exe	73

C:\Users\Admin\AppData\Local\Temp\k6689391.exe
"C:\Users\Admin\AppData\Local\Temp\k6689391.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1336

memory/1336-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1336-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1336-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1336-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1336-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download