976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e

Analysis

max time kernel
119s
max time network
135s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
23/10/2023, 20:41

Target

976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe
Size

1.8MB
MD5

2f990ff02ba21f26e1304feaccc8f58b
SHA1

8cc96c931369711ac4b1ba6f7c94bd719a4f2787
SHA256

976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e
SHA512

b56631b83ea655982db239f431f86fbe40752c35118efecd0dcc75dadc5db496efeac9cdf1b505a35add96a9afc95a6536a4c9484aa926980d00f0415a35c1e1
SSDEEP

24576:OVAfSfS8a1TTPEX1xo6a9DhvhQ3yKecmNI:O1S8a1Tw166a3vNKec+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5060	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	71
PID 4836 wrote to memory of 5060	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	71
PID 4836 wrote to memory of 5060	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	71
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72
PID 4836 wrote to memory of 3156	4836	976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe	72

C:\Users\Admin\AppData\Local\Temp\976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe
"C:\Users\Admin\AppData\Local\Temp\976e56e97c6be613a162b0e121a7865836993d7c3da662db539974d9769b719e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3156

memory/3156-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3156-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3156-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3156-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3156-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download