fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 05:14

Target

fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe
Size

1.1MB
MD5

c15d86c21170c1e82384f62fedff6e3a
SHA1

65fc9f7560508c268243ebb6146ef1cd8263cd42
SHA256

fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a
SHA512

c6476e270a1b566ab42d1cff04e716b14c5eb73275f069afe01e4bc1e92abe6e7d2899260c87748561e6950eec1653bda79fdb93d958e9152b921230222d9e4a
SSDEEP

12288:dnkV0j9PPm7ChMMIAn1899+hoJTNkDm3pWF4KZXSso8iPYDz0uFu0SqfHv9ryFsR:lmChMF9+hoROtZX48TpnCskuPB

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91
PID 1548 wrote to memory of 1104	1548	fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe	91

C:\Users\Admin\AppData\Local\Temp\fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe
"C:\Users\Admin\AppData\Local\Temp\fe77d71f9c1958d07cd753220c786e414091c139e23cff16ac7068e5b75d099a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1104

memory/1104-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1104-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1104-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1104-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1104-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download