f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5

Analysis

max time kernel
127s
max time network
135s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
03-11-2023 04:55

Target

f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe
Size

1.0MB
MD5

fa0b41206d45a265df06d49aba1b62d5
SHA1

0546d21e880c5157b5e2acc62a15b938cd65754e
SHA256

f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5
SHA512

8f7b02a7547724c3c07e505b6ebc1bf44fc5a38abccea2198bbbaaa967515a488f307b58c51ee3a83c494caabdc040701b544d1d1e0408427b4ebee37cc861c6
SSDEEP

12288:frB5wY40FwPenT2U7vqxIdU7TYnrL9dpxf2xhguuSVKuqh86hVB2ZuMJRFWiWN:HV4owPenT2U7vqULnrLBFw+hKuMJmi

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71
PID 3920 wrote to memory of 752	3920	f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe	71

C:\Users\Admin\AppData\Local\Temp\f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe
"C:\Users\Admin\AppData\Local\Temp\f7f8da71b71a30902ea8235029513e2b7d9fd91e9db38aeaff27a8ea25d437c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:752

memory/752-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download