383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 20:52

Target

383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe
Size

1.8MB
MD5

f3b655f283a9616582c0dfb6eecfe4f3
SHA1

36259ca22e411a20d597cbcd51cab1b00c1adbd1
SHA256

383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40
SHA512

2123ba31dae83789868a514c79d2f130c07a585457d20c1a13b117964aed023016c25bd8a2b576505511fd31d509505a82b20725e8316eabbd809888839aa245
SSDEEP

24576:nfAfSfS8a1TD3EvdxE6a9DhvhW23DVmsI:nLS8a1TAdW6a3v13DVms

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 376 set thread context of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84
PID 376 wrote to memory of 760	376	383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe	84

C:\Users\Admin\AppData\Local\Temp\383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe
"C:\Users\Admin\AppData\Local\Temp\383e208599613c9e1f7460ecd3c74b1d74218823c9463dac0f3fd1efc3fdde40.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:760

memory/760-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/760-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/760-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/760-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/760-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download