53071a0cb873e7a4c1a94158121abe183089514dcb46fe9752244211e8d960df

Analysis

max time kernel
90s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 01:14

Target

7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe
Size

371KB
MD5

25c0ef13f3b36ef0b77679850764f0ec
SHA1

19fbc6fdc8300ec40134f90ad63ab2da1eb1a0ed
SHA256

7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0
SHA512

fe7a83a06c9fb06ef18398411bde809af433183f210e267187d9e41cd9a38d09afcc2d6f4c2bed75cc56e6e1040f79fc0fe4ef7bdd810d92f83279fc0a74d28f
SSDEEP

6144:j9vJm09zORs+z/TMify9DAOBgQzEbjeAm5SimSI8/:jlw09CK5NQaACAmID8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4604 set thread context of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3692	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	87
PID 4604 wrote to memory of 3692	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	87
PID 4604 wrote to memory of 3692	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	87
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88
PID 4604 wrote to memory of 3828	4604	7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe	88

C:\Users\Admin\AppData\Local\Temp\7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe
"C:\Users\Admin\AppData\Local\Temp\7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3828

memory/3828-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download