226ce544a88c9114ce0a239706f5f56740cefdbbe7ab1588019ec695c890385d

Analysis

max time kernel
136s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 19:57

Target

39ae4f7ace727712daf6a593f5ad4ab5.exe
Size

608KB
MD5

39ae4f7ace727712daf6a593f5ad4ab5
SHA1

e3bb544c84d062e18525e1b4350e247d888b80b0
SHA256

226ce544a88c9114ce0a239706f5f56740cefdbbe7ab1588019ec695c890385d
SHA512

148867412f9900db1a93d5d5618b4b4985950fccab09f821148e79e2b3ee2873468088573612e7a67e92f3ccb4ce98ceb59bd2b6878c36f4d94d018cd542a748
SSDEEP

12288:NuMV+HYuCmEUQQpKe5d05nBXYcfA/LcEl+GM:MU+HRvQze5dmnBIcfcW

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 3500	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	91
PID 368 wrote to memory of 3500	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	91
PID 368 wrote to memory of 3500	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	91
PID 368 wrote to memory of 1968	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	92
PID 368 wrote to memory of 1968	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	92
PID 368 wrote to memory of 1968	368	39ae4f7ace727712daf6a593f5ad4ab5.exe	92

C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
"C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\39ae4f7ace727712daf6a593f5ad4ab5.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1968

memory/368-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/368-1-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/368-2-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/368-3-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/368-4-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1968-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1968-5-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1968-12-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1968-14-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3500-6-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3500-8-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3500-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3500-13-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download