ff43602a591f2130c3c8fa71922a31abc01641e7ff048bf2e08e3d3d59c24253

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 15:05

Target

59051aeced793e477a13ce4f6ef1313c.exe
Size

37KB
MD5

59051aeced793e477a13ce4f6ef1313c
SHA1

1b52875eb7796037145089c9b2868882b549d7c7
SHA256

ff43602a591f2130c3c8fa71922a31abc01641e7ff048bf2e08e3d3d59c24253
SHA512

76c4d51ec8d77186598821b19ea371b72d706be8127a3643c2660a8608822624f0c2099b23112be055586514c5ef27e72f0e2340206f9674c71360320e50c4ad
SSDEEP

768:edIZ/alwuAknNWuCMQpb0ruFm1YqTrmHwbLyMy8:edILlknNU4rOobbLyn8

Score

7^/10

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	59051aeced793e477a13ce4f6ef1313c.exe
4464	59051aeced793e477a13ce4f6ef1313c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90
PID 4500 wrote to memory of 4464	4500	59051aeced793e477a13ce4f6ef1313c.exe	90

C:\Users\Admin\AppData\Local\Temp\59051aeced793e477a13ce4f6ef1313c.exe
"C:\Users\Admin\AppData\Local\Temp\59051aeced793e477a13ce4f6ef1313c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\59051aeced793e477a13ce4f6ef1313c.exe
  "C:\Users\Admin\AppData\Local\Temp\59051aeced793e477a13ce4f6ef1313c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

memory/4464-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4464-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4464-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4464-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download