38f8319ff342f08ae81218d3ef066c17667d74556d0fe2993492313770d9490d

Analysis

max time kernel
152s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:44

Target

28b24a9725e8c547ed5dc678515533a2.exe
Size

333KB
MD5

28b24a9725e8c547ed5dc678515533a2
SHA1

a344f3da716d214e3233ce84b9f51be32a90d79e
SHA256

38f8319ff342f08ae81218d3ef066c17667d74556d0fe2993492313770d9490d
SHA512

5cd0d0043711e7323b242ca64d9795821ec6d0f3e0c00b1a8f3105fff1e201c884b7663d02d4582cc35519133020e2e2faf0c24dba19ec3e86c4416533fa72ed
SSDEEP

6144:GojcLzVWRhSFwCoqsO3s/1paRROvRtgDYTTAUXX:FcLzloqsO8/0RO5tVf5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93
PID 1612 wrote to memory of 408	1612	28b24a9725e8c547ed5dc678515533a2.exe	93

C:\Users\Admin\AppData\Local\Temp\28b24a9725e8c547ed5dc678515533a2.exe
"C:\Users\Admin\AppData\Local\Temp\28b24a9725e8c547ed5dc678515533a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\28b24a9725e8c547ed5dc678515533a2.exe
  "C:\Users\Admin\AppData\Local\Temp\28b24a9725e8c547ed5dc678515533a2.exe"
  2⤵
  PID:408

memory/408-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/408-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/408-6-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/408-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1612-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1612-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download