86df8ba1cd3d406b735a97cf39f476880b26f704910745d4e1fe4e173846379b

Analysis

max time kernel
171s
max time network
245s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:53

Target

k9923261.exe
Size

371KB
MD5

fc52cd375f3f015cfb2aff8721133e8d
SHA1

357b322d6609f50e0b29a7eb51e755d25360ff24
SHA256

86df8ba1cd3d406b735a97cf39f476880b26f704910745d4e1fe4e173846379b
SHA512

1a150f51105d0a1731e30b35dfb0eb6034a8a9cc7afff06a02b9209c2ca6b3691cf518cf278a453e25e39f75ba604488f6227d051071ca6edc087cb44a7ceb8b
SSDEEP

6144:hbvJm09zORs+z/TMify9DAObgQfyIBjtUAo0BuhiRWbKC8z+YGkh8/:h7w09CK5N6CBjz+kl8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

k9923261.exe

description pid process target process

PID 1388 set thread context of 4944 1388 k9923261.exe AppLaunch.exe

description	pid	process	target process
PID 1388 set thread context of 4944	1388	k9923261.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

k9923261.exe

description	pid	process	target process
PID 1388 wrote to memory of 3608	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 3608	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 3608	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe
PID 1388 wrote to memory of 4944	1388	k9923261.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\k9923261.exe
"C:\Users\Admin\AppData\Local\Temp\k9923261.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:4944

memory/4944-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download