25e8f920838a4eb6e629057269581ad50263648fe08454da33839ad43b9de23c

Analysis

max time kernel
138s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 13:36

Target

57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe
Size

328KB
MD5

94d77950317c207c16b16fae18386e11
SHA1

7c7691f3cd41d068935b7da9daad29a2cb978ebf
SHA256

57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a
SHA512

aaf4eb2dcc850e3ac7d2714a93ba91544cb5bb1008caa01b1b9d758da4a0ab56348bf81e7e03f9ac82c85d0f6da77872ea990c9be4e334eb7fb1d6d2975b6b73
SSDEEP

6144:XkZrUxBda9xwyHlC4HTDUsExpMii7aIURc4rNItDYM2a0+brp0JDfW6:0ZraBdKweCewbMaIURc4RkDXKpfW6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82
PID 4756 wrote to memory of 60	4756	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	82

C:\Users\Admin\AppData\Local\Temp\57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe
"C:\Users\Admin\AppData\Local\Temp\57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:60

memory/60-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/60-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/60-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/60-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/60-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download