3e8b1ea84ad2d991323a9df69f5bedece5252c0f7cb83139a25f9441ca98a131

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:51

Target

12a2b6c279a648577e1ce5fa1a35afc3.exe
Size

604KB
MD5

12a2b6c279a648577e1ce5fa1a35afc3
SHA1

d9f25ad9e5705246278df8aab3762c0a5be7fc64
SHA256

3e8b1ea84ad2d991323a9df69f5bedece5252c0f7cb83139a25f9441ca98a131
SHA512

36444c069c0763c22f06ab71570eb9818db937c978324a94610dbc37a3362ddbb4596cee4e75415c8193dcb02bdb721c6e197dd82590ad8eb85280e16283dcfe
SSDEEP

12288:iTC7O4L2AudlNj0E852PaPuou8UYYZY/BwTDKlu/cQ/4M:iTCK4L0Nj0l5x1u8IZYpwTDKlu/cs

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4640	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	89
PID 4052 wrote to memory of 4640	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	89
PID 4052 wrote to memory of 4640	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	89
PID 4052 wrote to memory of 2636	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	90
PID 4052 wrote to memory of 2636	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	90
PID 4052 wrote to memory of 2636	4052	12a2b6c279a648577e1ce5fa1a35afc3.exe	90

C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
"C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2636

memory/2636-8-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2636-12-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2636-9-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4052-3-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4052-5-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4052-0-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4052-2-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4052-1-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4052-13-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4640-6-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4640-7-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/4640-10-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4640-11-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download