221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 22:05

Target

1481ef11e6802b82ba272ffa154f4b64.exe
Size

601KB
MD5

1481ef11e6802b82ba272ffa154f4b64
SHA1

d35e60906614c715a52c3f9fbb774334ea1ae226
SHA256

221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e
SHA512

237af16d6757d6807000266a4cd75767b7bab6bd1769f9c18306ba16484b2310eaa024e01e078206af31254187e68258cd29c336f09a96d6a102cc72ff845d63
SSDEEP

12288:KSracAq96saVWWgQp/mfwRDYdyRgvZXqyd8BwxpImEcM66C2:KS+c796saVWqmYXRgv8BOpImEu4

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1792	1876	1481ef11e6802b82ba272ffa154f4b64.exe	94
PID 1876 wrote to memory of 1792	1876	1481ef11e6802b82ba272ffa154f4b64.exe	94
PID 1876 wrote to memory of 1792	1876	1481ef11e6802b82ba272ffa154f4b64.exe	94
PID 1876 wrote to memory of 4960	1876	1481ef11e6802b82ba272ffa154f4b64.exe	93
PID 1876 wrote to memory of 4960	1876	1481ef11e6802b82ba272ffa154f4b64.exe	93
PID 1876 wrote to memory of 4960	1876	1481ef11e6802b82ba272ffa154f4b64.exe	93

C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
"C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1792

memory/1792-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1792-8-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/1792-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1792-10-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1876-0-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1876-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1876-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1876-2-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1876-12-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4960-9-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4960-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4960-11-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download