6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2023, 17:31

Target

6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe
Size

1.1MB
MD5

bfc778a74523669f14602f766da44396
SHA1

c276ddcdbd3b22946bdda9541461ddf1320acf74
SHA256

6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874
SHA512

ee0235286e5fe47dd8873dd9e46c77bed681920c369e2e747972f046335a8d20889b766add56df0ab81a9a5b80f974d6e76191cdf501a08ccb45da626277c64f
SSDEEP

24576:uG5mtww5o7a0dGD5/yDZIifhFQtuXio4q:05o7a0daAD5LoUihq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3832 set thread context of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88
PID 3832 wrote to memory of 4720	3832	6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe	88

C:\Users\Admin\AppData\Local\Temp\6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe
"C:\Users\Admin\AppData\Local\Temp\6bce46ca87fea4f82d0337abc40e1791dfa0494b1c2ecd0be80422926b502874.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4720

memory/4720-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download