b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 19:06

Target

b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe
Size

1.8MB
MD5

848dfe78898d737a833e9bdf944c8275
SHA1

b8cc7eda84a54f5c814e001d67ef120b300d5e79
SHA256

b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f
SHA512

1824f3b70596c5271c6dfdc1fc4f17a938e343d529775b701a61cdb4de9e94ddeb78118ccedcd333118777809b4035cff75afda0f832f6f93f72dd08d69b733c
SSDEEP

24576:vTAfSfS8a1TD3EvdxE6a9DhvhhWobw/TI:vPS8a1TAdW6a3vs/T

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3868 set thread context of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	84
PID 3868 wrote to memory of 2000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	84
PID 3868 wrote to memory of 2000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	84
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85
PID 3868 wrote to memory of 3000	3868	b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe	85

C:\Users\Admin\AppData\Local\Temp\b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe
"C:\Users\Admin\AppData\Local\Temp\b0a24fd7d731b0cba08a3bde98c758fcd25562b30451e60abc15b41c6ecf674f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3000

memory/3000-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3000-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3000-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3000-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3000-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download