1268780bd4d4e27f57c90a494a97660c31ef85e12054632e45bea9b4a915ff12

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 20:26

Target

3b34b8222e2f367795e5c64459bb6414.exe
Size

602KB
MD5

3b34b8222e2f367795e5c64459bb6414
SHA1

ebba945d69c94aac61771eddbcd422fc64025e3b
SHA256

1268780bd4d4e27f57c90a494a97660c31ef85e12054632e45bea9b4a915ff12
SHA512

6b3c11360c7edbca280ab7b7848b975631893e2d963dec2627c7fe6571e169c3c809f855676cb454426f64c5205eed1ce524f1090c924cac1b28f434771dfb32
SSDEEP

12288:cU0/GFk2qgwSp31LXgRDK6niecVEIlsMbhOB8Rc7KRFMD:Al2qs4n1wHKQhPi

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	3b34b8222e2f367795e5c64459bb6414.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 464	1544	3b34b8222e2f367795e5c64459bb6414.exe	90
PID 1544 wrote to memory of 464	1544	3b34b8222e2f367795e5c64459bb6414.exe	90
PID 1544 wrote to memory of 464	1544	3b34b8222e2f367795e5c64459bb6414.exe	90
PID 1544 wrote to memory of 4500	1544	3b34b8222e2f367795e5c64459bb6414.exe	89
PID 1544 wrote to memory of 4500	1544	3b34b8222e2f367795e5c64459bb6414.exe	89
PID 1544 wrote to memory of 4500	1544	3b34b8222e2f367795e5c64459bb6414.exe	89

C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
"C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  PID:464

memory/464-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/464-9-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1544-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1544-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1544-2-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1544-3-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1544-5-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1544-4-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4500-8-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4500-6-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4500-10-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download