0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 17:28

Target

0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
Size

680KB
MD5

356f615eb12a2da9a61483e51a42ceec
SHA1

6acd233bd9cbcf3a0e665a88de9647f633da6c6a
SHA256

0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8
SHA512

194b5e49c0d06dc38cde815347ac7c232621d3338b158fba9c81834d14f580a7825a81122ec78b6ddcf8b3c2831d070677c69a464501261cae2f4a6793ea8565
SSDEEP

12288:pGbiSAx5PWPQA0pWlBbsn3EWdzpIbXKL31SM1XlLSBsjzC0KeHoWbVtQ/tE:pG7Ax5uPg5+W3kMSBsjHR5tQVE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3744 set thread context of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4120	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
4120	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97
PID 3744 wrote to memory of 4120	3744	0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe	97

C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

memory/3744-8-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download
memory/3744-9-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/3744-2-0x0000000002690000-0x00000000026A0000-memory.dmp

Filesize
64KB

Download
memory/3744-3-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/3744-4-0x0000000004E80000-0x0000000004F12000-memory.dmp

Filesize
584KB

Download
memory/3744-5-0x0000000004FC0000-0x000000000505C000-memory.dmp

Filesize
624KB

Download
memory/3744-1-0x0000000000240000-0x00000000002EE000-memory.dmp

Filesize
696KB

Download
memory/3744-6-0x0000000004F90000-0x0000000004FA2000-memory.dmp

Filesize
72KB

Download
memory/3744-0-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-7-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-10-0x0000000005060000-0x000000000506C000-memory.dmp

Filesize
48KB

Download
memory/3744-11-0x0000000006240000-0x00000000062BA000-memory.dmp

Filesize
488KB

Download
memory/3744-14-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/4120-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4120-15-0x00000000016F0000-0x0000000001A3A000-memory.dmp

Filesize
3.3MB

Download
memory/4120-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download