b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa

Analysis

max time kernel
154s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 23:26

Target

b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe
Size

1.1MB
MD5

ed75a046e4e333cfaf3035fbf27a0b05
SHA1

f8d7b58b8847753422cb00ccde3c599c36ab4a9c
SHA256

b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa
SHA512

cf545f3aa1fa36a00b7206d151c226622c65e0432d4ed6b8ceee7194f8c009ffce89247c29637732b308bb1dad241312aa42ffbc4c9b67cff4bee063e880d39c
SSDEEP

24576:zWAPendTZihaqXFYGevIXDQX/+GSKU0M:aJTZihaqX+RIXEX/T1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4296	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	86
PID 4260 wrote to memory of 4296	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	86
PID 4260 wrote to memory of 4296	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	86
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87
PID 4260 wrote to memory of 1652	4260	b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe	87

C:\Users\Admin\AppData\Local\Temp\b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe
"C:\Users\Admin\AppData\Local\Temp\b3599fbb361613d2c9b160f10b8216724fbdb64f7c9936d2347d4a314c432dfa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1652

memory/1652-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1652-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1652-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1652-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1652-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download