649c8ef74e35819c668d35f6d47d9822abb8d039f98dcb4f37e179ca9abe6e14

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 13:02

Target

file.exe
Size

393KB
MD5

1f5d049dcab776f87b0fbd5db1ca1f5c
SHA1

6efebc061ec9011d3aa8ee3b652dafa4fc650395
SHA256

649c8ef74e35819c668d35f6d47d9822abb8d039f98dcb4f37e179ca9abe6e14
SHA512

0acebc11063c3c72a1304f8dde929b4f1d44708e71a444f25b6291edd8fa4885b918ff20c00290e7aa4cba11fdf3df5c4df71d8a7fe688b065373832d8da1c1c
SSDEEP

6144:N5IjEe2jicP5iOo2T8VrSd/sUAOnklyGQGIFlJdVVaTFHz1Sa:N5ILqiG59ouRkOGoJdaTFHz1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 488	2028	file.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84
PID 2028 wrote to memory of 488	2028	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:488

memory/488-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/488-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/488-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/488-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/488-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download