a1ff015855ba1ac48cff4986392551677e9d949129821684a5e8fada6d6b3d80

Analysis

max time kernel
142s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:36

Target

2036bc58705189d6c3008ee24fb4c7db.exe
Size

7KB
MD5

2036bc58705189d6c3008ee24fb4c7db
SHA1

b040ef7a34533d6e3e42c0cca21140683282f994
SHA256

a1ff015855ba1ac48cff4986392551677e9d949129821684a5e8fada6d6b3d80
SHA512

89e879efdc41922d807a306bd1f90b6faa8e9067e3c14a5548fdd13e6966e1ac4f745e8710386dde5ce5d51eaf211b8a71ab4a8cde0ce041751c6f78136aacb5
SSDEEP

192:DLlwZxiWeirHZ5pzlmNXEXALsl7usOwni:n2oWnrHZvzQXbshu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4072 set thread context of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92
PID 4072 wrote to memory of 3712	4072	2036bc58705189d6c3008ee24fb4c7db.exe	92

C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe
"C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe
  "C:\Users\Admin\AppData\Local\Temp\2036bc58705189d6c3008ee24fb4c7db.exe"
  2⤵
  PID:3712

memory/3712-1-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/3712-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/3712-6-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/3712-7-0x0000000000400000-0x0000000000401800-memory.dmp

Filesize
6KB

Download
memory/4072-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4072-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download