48dd895fb56fb5f4d5732b7c5ffa847a5339c6e0e832e24d6fd564b2cddb230c

Analysis

max time kernel
142s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:54

Target

1e7c478f3a26addf78fed6d77dd4759d.exe
Size

37KB
MD5

1e7c478f3a26addf78fed6d77dd4759d
SHA1

8543aaa1257c0af30bd797ee324018fafe2809f1
SHA256

48dd895fb56fb5f4d5732b7c5ffa847a5339c6e0e832e24d6fd564b2cddb230c
SHA512

3cbbefcc2b07ca3df006413a00c7530e5572aff88a21b719d30c0458d4966ee267cfd801f9f6c0b2d185fcb78d41076a6bd03bdf18ca2cd4f121c65dbe30b588
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMyC:edILlknNU4rOobbLynC

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1012	1e7c478f3a26addf78fed6d77dd4759d.exe
1012	1e7c478f3a26addf78fed6d77dd4759d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89
PID 5028 wrote to memory of 1012	5028	1e7c478f3a26addf78fed6d77dd4759d.exe	89

C:\Users\Admin\AppData\Local\Temp\1e7c478f3a26addf78fed6d77dd4759d.exe
"C:\Users\Admin\AppData\Local\Temp\1e7c478f3a26addf78fed6d77dd4759d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\1e7c478f3a26addf78fed6d77dd4759d.exe
  "C:\Users\Admin\AppData\Local\Temp\1e7c478f3a26addf78fed6d77dd4759d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012

memory/1012-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1012-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1012-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1012-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1012-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download