49aeabd3f7e08710ee1ef11b594243e52e6effb626c2bf5bda567cc43ef9a570

Analysis

max time kernel
72s
max time network
191s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:52

Target

k3020005.exe
Size

393KB
MD5

9c23875d800f4a3440360c85d420ad39
SHA1

c4a6c94c7c6b5d3d37d4612cec1ceb8ed3b19857
SHA256

49aeabd3f7e08710ee1ef11b594243e52e6effb626c2bf5bda567cc43ef9a570
SHA512

f761c5d81ea1c7494875377163f1fdce1cddc72b9af6051a8e358bdb15617890d4a66554f40b134b2b96f910f21feff59e182fb887d8dbe71f91e1afb9028ffe
SSDEEP

6144:xL4jE+2jicP5iOo2T8VrSd/sUAOfklq9PiwUj/yLCIrZ4pyqI49A7LordHLxB5Fq:xL4rqiG59outkCPiwUj21yKclWz1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k3020005.exe

description pid process target process

PID 2128 set thread context of 4436 2128 k3020005.exe AppLaunch.exe

description	pid	process	target process
PID 2128 set thread context of 4436	2128	k3020005.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

k3020005.exe

description	pid	process	target process
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe
PID 2128 wrote to memory of 4436	2128	k3020005.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\k3020005.exe
"C:\Users\Admin\AppData\Local\Temp\k3020005.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:4436

memory/4436-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download