4ff55a219ec1d040dae321e14c0ddb27f02ac7933d795c7431c7bfb05271d9aa

Analysis

max time kernel
157s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 13:43

Target

file.exe
Size

328KB
MD5

a1174109f02b328ba1f96aa7d7ea3e9a
SHA1

3a6521a3e38253003c7891299ef0e1777a72e34d
SHA256

4ff55a219ec1d040dae321e14c0ddb27f02ac7933d795c7431c7bfb05271d9aa
SHA512

707a237d12d58de9302c0e789620831e9c33cdb75764349fa3ddd9090bd80e6cf90ee43b1e4089f206ad501457c502a6445c31d0dac6bbfddd607b10fd387e11
SSDEEP

6144:8wZrUxBda9xwyHlCv3F9jn54qQpOyilwFRjxk9ei9cfOZyEJuVi6rkwdDfW6:7ZraBdKweC/j5dKeei2f0zuprkwdDfW6

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 2844	364	file.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83
PID 364 wrote to memory of 2844	364	file.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2844

memory/2844-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2844-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2844-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2844-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2844-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download