dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa

Analysis

max time kernel
133s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:24

Target

dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe
Size

1.1MB
MD5

692a59e85b4c932049ab55cb372a9509
SHA1

5a6ce3a44a42ca0c79d322cd4338685d8f8a1ccf
SHA256

dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa
SHA512

6cba914d55b498f0f190f7dba539d73b660b86326d4f9fb8a7834c771a41899909e7f4d2fed63efec3e8a6218a3da714c300d5c378e85847408c40741d90d692
SSDEEP

24576:bREW9gH1dNmfEqWZ6YeIPjvAwhXEoNqyXTo0o:bRs1dNmfbL1whXJrXTo0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2116 set thread context of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91
PID 2116 wrote to memory of 4480	2116	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	91

C:\Users\Admin\AppData\Local\Temp\dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe
"C:\Users\Admin\AppData\Local\Temp\dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4480

memory/4480-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download