4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5

Analysis

max time kernel
124s
max time network
131s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
13-10-2023 13:03

Target

4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe
Size

1.1MB
MD5

a1c1c44e837edbc2d55d33ba9620a109
SHA1

0ba4e08d7b6f17f968d1f7cad75d0a3885bae998
SHA256

4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5
SHA512

75267e9d0652e006107506457c5253fe701149888ad977d95f52d215410b18e3b145c8779ae389b718f090c5aa41d614e45deb38a96852a07a299a5b075c02bc
SSDEEP

12288:ZnkV0UWd14psxyE+dxuQ3BS9sWBAZjCJoufPPfoYjQGut8Cr5BRe71QrCeht3CfD:0psxyE+dxuYvZjVSPOrw43hzYh3

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe

description	pid	process	target process
PID 4316 set thread context of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe

description	pid	process	target process
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe
PID 4316 wrote to memory of 5016	4316	4160c00350706d7630b0a8bfb47722e7ec956858ab07d5adc9345e37ccb751e5.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5016

memory/5016-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5016-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download