50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f

Analysis

max time kernel
117s
max time network
138s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
13-10-2023 11:57

Target

50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe
Size

1.1MB
MD5

a1657ee50a168f01d31d3a2c62242b49
SHA1

f9b5a2e0a5d46c38454e2eabe98b1be51a61f4fb
SHA256

50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f
SHA512

4f1c1aaa827b25535d74e0580ebe8bacd31ba9bfedd03c7b26813d57656a1b25e1fd342655ab647a2a56d1bcc3d3180530c645446762cd64f3aa7b3aa20e05c7
SSDEEP

12288:9nkV07CdS4psxyE+dxuQHrK9EW8AZD5doufPP2ogWjGut8qT5BRe71QKC2nFT+do:+psxyE+dxuYIZDcSGwT0A7c

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71
PID 1152 wrote to memory of 3776	1152	50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe	71

C:\Users\Admin\AppData\Local\Temp\50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe
"C:\Users\Admin\AppData\Local\Temp\50c4189eaa615925e1bdef73f9a848bec20d570cd6ee6218e977b4b307aaf34f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3776

memory/3776-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3776-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3776-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3776-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3776-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download