f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099

Analysis

max time kernel
132s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 20:54

Target

716dc67ab6a30a38edd5e4ca46df4d87.exe
Size

535KB
MD5

716dc67ab6a30a38edd5e4ca46df4d87
SHA1

054c72639fcba7d3bf94dcbe2f630fe3ad1ce986
SHA256

f5921e86b2c6700bce14af3207fb722a952da1d697f19b7082da28ba34536099
SHA512

e16f6102c4aad75a2f62ed9f696da3f5391a196bf7c88450d3fd71e17c153aea7b32158ff3ba2d2886165877feaad7d4480df2402bcb23d7a2e1a80c29463bae
SSDEEP

6144:knjH5WJwWFLI8H6I1Z1pfakSkDjmgCCFHXbuhs/j9qc5Jisw5pH2GAU6sCCHcfwN:ojZWJwW2OP71xHnDqfC5jQc5YWscYG2

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87
PID 4732 wrote to memory of 116	4732	716dc67ab6a30a38edd5e4ca46df4d87.exe	87

C:\Users\Admin\AppData\Local\Temp\716dc67ab6a30a38edd5e4ca46df4d87.exe
"C:\Users\Admin\AppData\Local\Temp\716dc67ab6a30a38edd5e4ca46df4d87.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\716dc67ab6a30a38edd5e4ca46df4d87.exe
  "C:\Users\Admin\AppData\Local\Temp\716dc67ab6a30a38edd5e4ca46df4d87.exe"
  2⤵
  PID:116

memory/116-3-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/116-5-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/116-6-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/116-7-0x0000000000600000-0x0000000000632000-memory.dmp

Filesize
200KB

Download
memory/116-9-0x0000000000600000-0x0000000000632000-memory.dmp

Filesize
200KB

Download
memory/116-10-0x0000000000600000-0x0000000000632000-memory.dmp

Filesize
200KB

Download
memory/116-8-0x0000000000600000-0x0000000000632000-memory.dmp

Filesize
200KB

Download
memory/116-11-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4732-1-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/4732-2-0x0000000000B30000-0x0000000000BCB000-memory.dmp

Filesize
620KB

Download