6f47ce8d481819b0aa5bbf8dd18e7901ec39a7e3304493ce8a60ffbefb9a9b8d

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:24

Target

8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe
Size

1.0MB
MD5

6749e5d28d5a6967a4b90d10a6af05c0
SHA1

2e4db576c1a56c3cd99310d5dbc32a5b013b91c5
SHA256

8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91
SHA512

1ca7583e887f235f3180c6e161c84e02b7549eb655bb6a1d0b0e5efc112e9f9d8f7d33faaa8c51798e41ca0f6ce64c045a4ecabbda2dd0ac3b9784463f9edd9f
SSDEEP

12288:bqEmJ0wR2nmfCMLug57y5Dc+8dO+8ZKqNMDc7ulyoy+dPdADPj3L:DRRnmfCMLug5GJ7FZKqNMPdADPj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1692	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	89
PID 3456 wrote to memory of 1692	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	89
PID 3456 wrote to memory of 1692	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	89
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90
PID 3456 wrote to memory of 3136	3456	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	90

C:\Users\Admin\AppData\Local\Temp\8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe
"C:\Users\Admin\AppData\Local\Temp\8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3136

memory/3136-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download