5919dd2022a42c96055c48a8f78cb90d618509e58bdb070ce347510290044e62

Analysis

max time kernel
147s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 18:35

Target

0c50327a8050dacd84a14b04839816b9.exe
Size

72KB
MD5

0c50327a8050dacd84a14b04839816b9
SHA1

64792a83a67c570ff06791b5a4d46d460cf523fe
SHA256

5919dd2022a42c96055c48a8f78cb90d618509e58bdb070ce347510290044e62
SHA512

12eb2a24b19c3b49d724c73f047e910c8629e0d7032a0b9e5f0fffbd669652919502b11cab53b8087a578b5349ecb3603a5968156f2cee88d480b7b67ed87139
SSDEEP

1536:EgQ2zo/r9BEE7zHGhew47LImLKRAHmf2YeUP:EgQlRBEE7zG4wfUfGf2YV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96
PID 744 wrote to memory of 1160	744	0c50327a8050dacd84a14b04839816b9.exe	96

C:\Users\Admin\AppData\Local\Temp\0c50327a8050dacd84a14b04839816b9.exe
"C:\Users\Admin\AppData\Local\Temp\0c50327a8050dacd84a14b04839816b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\0c50327a8050dacd84a14b04839816b9.exe
  "C:\Users\Admin\AppData\Local\Temp\0c50327a8050dacd84a14b04839816b9.exe"
  2⤵
  PID:1160

memory/744-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/744-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/744-2-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/744-1-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/1160-6-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1160-3-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download