ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea

Analysis

max time kernel
124s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 13:34

Target

ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe
Size

393KB
MD5

95d87225713c6998a6abe498db75af93
SHA1

5f6bae5f483cc222bb90e3f9af8bc8ebfd56eae7
SHA256

ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea
SHA512

c72943958d42761ba2c081b7ddcfde17742f6a119a0493d47dbf210a52fe6e4304ddb4bc5628dc2af5084d51bde2ac7c163e8fe0727507a4122a3781d43cceac
SSDEEP

6144:npvjEH2jicP5iOo2T8VrSd/sUAORkl9i2foCJjjVJoe1aLsc08xRZVfMl1Sa:npviqiG59ounkPi2Q4HVJF8vZ9A1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84
PID 2948 wrote to memory of 3900	2948	ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe	84

C:\Users\Admin\AppData\Local\Temp\ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe
"C:\Users\Admin\AppData\Local\Temp\ba15f738e5e9a7502e1451746cda61b5c62b8cf59737ee28315ae6733d5543ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3900

memory/3900-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3900-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3900-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3900-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download