4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f

Analysis

max time kernel
120s
max time network
125s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
29/10/2023, 18:35

Target

4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe
Size

1.1MB
MD5

e35426076faa5ea7ee344d9f852f952e
SHA1

a5afbf1457c7b85df597066a346856e2ae046837
SHA256

4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f
SHA512

887515e3dfdc3d9aa2552b0a529b93667fca73792b0ec0ea2cb48e69a243a8ea6267802b34228929eef3d8514041a4f770ee4ea66addfac6db818a0d0839cbee
SSDEEP

12288:R768yKPXDQmtwwZo7a0dYkum4P+8/CQseIZPdNnkOKgiu+CCKEhhYzmcJ+:RJImtwwZo7a0dBy5/CFRcytEhum

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71
PID 1496 wrote to memory of 4532	1496	4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe	71

C:\Users\Admin\AppData\Local\Temp\4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe
"C:\Users\Admin\AppData\Local\Temp\4caf50ff3e8c94cc77b25d138b201b4ccd5877b21683d114fa902bb0ad3b948f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4532

memory/4532-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-6-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download