415109a24046048bc1d74abd2945c1476d4c8c308148a8c2f99e27acfe8b97df

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2023, 09:53

Target
f1c8192229b6047748966d7db857a3e2.exe
Size 320KB
Sample231017-lwmchsce82
SHA256 415109a24046048bc1d74abd2945c1476d4c8c308148a8c2f99e27acfe8b97df
MD5 f1c8192229b6047748966d7db857a3e2
SHA1 2ceb28922464eb5dc79b6658608a0cce46666d7b
SHA512 8fdc8dda44b099b7574d57610740fca77a5fd4771e805c40d03a987a42bb0d17e4205b6b2f721e5d332b5e46899afcb6938c8c8675a34bae20231d406351cf35
SSDEEP 6144:PvK3l99cV4ETXhVVonX97PGkJDjfv/wdljmVQOFxnd:nK199iVElPFfUYxnd
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4580 set thread context of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91
PID 4580 wrote to memory of 4100	4580	f1c8192229b6047748966d7db857a3e2.exe	91

C:\Users\Admin\AppData\Local\Temp\f1c8192229b6047748966d7db857a3e2.exe
"C:\Users\Admin\AppData\Local\Temp\f1c8192229b6047748966d7db857a3e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4100

memory/4100-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4100-2-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4100-1-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4100-3-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4100-4-0x0000000000400000-0x0000000000432000-memory.dmp

Download