221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e

Analysis

max time kernel
0s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:28

Target

1481ef11e6802b82ba272ffa154f4b64.exe
Size

601KB
MD5

1481ef11e6802b82ba272ffa154f4b64
SHA1

d35e60906614c715a52c3f9fbb774334ea1ae226
SHA256

221aab880c468ec670c8d35546206381b6f643fae2b7a62e6346f1bc9a52dd3e
SHA512

237af16d6757d6807000266a4cd75767b7bab6bd1769f9c18306ba16484b2310eaa024e01e078206af31254187e68258cd29c336f09a96d6a102cc72ff845d63
SSDEEP

12288:KSracAq96saVWWgQp/mfwRDYdyRgvZXqyd8BwxpImEcM66C2:KS+c796saVWqmYXRgv8BOpImEu4

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3316	1520	1481ef11e6802b82ba272ffa154f4b64.exe	26
PID 1520 wrote to memory of 3316	1520	1481ef11e6802b82ba272ffa154f4b64.exe	26
PID 1520 wrote to memory of 3316	1520	1481ef11e6802b82ba272ffa154f4b64.exe	26
PID 1520 wrote to memory of 2324	1520	1481ef11e6802b82ba272ffa154f4b64.exe	25
PID 1520 wrote to memory of 2324	1520	1481ef11e6802b82ba272ffa154f4b64.exe	25
PID 1520 wrote to memory of 2324	1520	1481ef11e6802b82ba272ffa154f4b64.exe	25

C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
"C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\1481ef11e6802b82ba272ffa154f4b64.exe
  start
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3316

memory/1520-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1520-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1520-2-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1520-4-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1520-0-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1520-3-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2324-7-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2324-8-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2324-11-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2324-10-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2324-14-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3316-12-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3316-6-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3316-13-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/3316-9-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download