49d546d89d8bfcc09cf0548d06fb13222ed4af37177deadcfa7f7cd411c9c5ab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:35

Target

269442887182df41917554ab89340ac2.exe
Size

37KB
MD5

269442887182df41917554ab89340ac2
SHA1

ce26c5dfdfa8577493f8c218b4a7334e4d945137
SHA256

49d546d89d8bfcc09cf0548d06fb13222ed4af37177deadcfa7f7cd411c9c5ab
SHA512

038128d63812c870aa93ca529cdaca6023ca5c1430a4222c57f5bfb8fa1d6421139de916c2547014abaa43cea9e0345ef10abbba7720ea2a126939718d455eb8
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMyp:edILlknNU4rOobbLynp

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 4448	212	269442887182df41917554ab89340ac2.exe	20

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	269442887182df41917554ab89340ac2.exe
4448	269442887182df41917554ab89340ac2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20
PID 212 wrote to memory of 4448	212	269442887182df41917554ab89340ac2.exe	20

C:\Users\Admin\AppData\Local\Temp\269442887182df41917554ab89340ac2.exe
"C:\Users\Admin\AppData\Local\Temp\269442887182df41917554ab89340ac2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\269442887182df41917554ab89340ac2.exe
  "C:\Users\Admin\AppData\Local\Temp\269442887182df41917554ab89340ac2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

memory/4448-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4448-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download