51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b

Analysis

max time kernel
71s
max time network
77s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
23-10-2023 22:45

Target

51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe
Size

1.8MB
MD5

32c198cebc76a5323c4983da604294ba
SHA1

0e93affc1bd4da86f57765958f1efc23f34c1162
SHA256

51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b
SHA512

68d90e4f92e06ff35e29af03323977dfc7a2123c30a670075190e34b22ac1f0c3e160c9167440ae814e37c3c7218ab6ab486ffdb4eb49df82373e73f8bd37455
SSDEEP

24576:A8AfSfS8a1TD3EvdxE6a9Dhvhx9f0LTtGegSI:AyS8a1TAdW6a3vGlGegS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71
PID 1576 wrote to memory of 888	1576	51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe	71

C:\Users\Admin\AppData\Local\Temp\51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe
"C:\Users\Admin\AppData\Local\Temp\51bce2e7c9c08bb5dbfb779e9bc170a69aa820b3f6f330c0e599e7068953a52b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:888

memory/888-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/888-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/888-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/888-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/888-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download