3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5

Analysis

max time kernel
172s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 17:32

Target

46cd9ad791190d26c673e485bf7c0c2c.exe
Size

73KB
MD5

46cd9ad791190d26c673e485bf7c0c2c
SHA1

1c7609e268dce61118741ba8f00a483732bf216f
SHA256

3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5
SHA512

da21b3d01d780c7d73d45e0ab4d71976c6f62534ee5903ce096b363e66b516f92fe5143973d89046a7676746dc9507a6b17cc7e2b58586a54339dc52ea987f9d
SSDEEP

1536:NXSv0PZv5LLLLLLLL555vbbPZrrXZLrrrrNGXEypiOCjFp6WLNOKJ8tlzWnLTyvQ:BSv0PZv5LLLLLLLL555vbbPZrrXZLrrb

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2984	46cd9ad791190d26c673e485bf7c0c2c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 448 set thread context of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2984	46cd9ad791190d26c673e485bf7c0c2c.exe
2984	46cd9ad791190d26c673e485bf7c0c2c.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 448 wrote to memory of 2984	448	46cd9ad791190d26c673e485bf7c0c2c.exe	93
PID 2984 wrote to memory of 2956	2984	46cd9ad791190d26c673e485bf7c0c2c.exe	94
PID 2984 wrote to memory of 2956	2984	46cd9ad791190d26c673e485bf7c0c2c.exe	94

memory/448-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/448-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2956-7-0x00007FF657A30000-0x00007FF657ECD000-memory.dmp

Filesize
4.6MB

Download
memory/2984-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2984-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2984-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2984-6-0x00000000770B2000-0x00000000770B3000-memory.dmp

Filesize
4KB

Download
memory/2984-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2984-10-0x00000000770B2000-0x00000000770B3000-memory.dmp

Filesize
4KB

Download