59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 14:48

Target

59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe
Size

393KB
MD5

870ef083e33a173fd11337586b9a0385
SHA1

deb6a4390d9d36e7f7a37e708dc59ea8047b9d21
SHA256

59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c
SHA512

6d2c5e1928488947a38ccd6ac8fa5789f58ace8040513f57a6d7b9ebddf067da60a2c50011732fad1fbd7c883287fb215ff98840f8a6e36b955734441c6fbc7d
SSDEEP

6144:Y+FjET2jicP5iOo2T8VrSd/sUAO6klThBDxvTrLgJ+hFjdTrPTwUQ1Sa:Y+F2qiG59ouEk/BDlgJ+hFj5wZ1Sa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 208 set thread context of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84
PID 208 wrote to memory of 4900	208	59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe	84

C:\Users\Admin\AppData\Local\Temp\59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe
"C:\Users\Admin\AppData\Local\Temp\59ea9347816fc5b7cbf5f38a152d67d115dfca537a0be7e654d7ae15ce08ce5c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4900

memory/4900-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download