c5e71ca1dcfe7975449a25d339036f3720b0b72aa52d8794b024442216487a4d

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 10:03

Target

9e1d9449d92d69c51a605225410f46f9.exe
Size

1.4MB
MD5

9e1d9449d92d69c51a605225410f46f9
SHA1

f6e4d110f48bb4264097dd3101ef791f2c3d01b0
SHA256

c5e71ca1dcfe7975449a25d339036f3720b0b72aa52d8794b024442216487a4d
SHA512

000904eeacc9cc086a9f666dc8cca356e4d1a0ec0fc79dd9032c1b37399a8d75585d4a9b874ca161a38675afe69fceb817482afba75f0e09fc11169fdf16227c
SSDEEP

24576:N8tYzPKod2UyOtEIh85b6vBIFPocvBlcjPPdoCmNIqS2IR0QQPyMzMZB84D:N8tOPKjp017vBIRvBluPdoCmNM2y08CU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

9e1d9449d92d69c51a605225410f46f9.exe

description pid process target process

PID 1456 set thread context of 2360 1456 9e1d9449d92d69c51a605225410f46f9.exe cmd.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9e1d9449d92d69c51a605225410f46f9.execmd.exe

pid process

1456 9e1d9449d92d69c51a605225410f46f9.exe
1456 9e1d9449d92d69c51a605225410f46f9.exe
2360 cmd.exe
2360 cmd.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

9e1d9449d92d69c51a605225410f46f9.execmd.exe

pid process

1456 9e1d9449d92d69c51a605225410f46f9.exe
2360 cmd.exe

description	pid	process	target process
PID 1456 set thread context of 2360	1456	9e1d9449d92d69c51a605225410f46f9.exe	cmd.exe

pid	process
1456	9e1d9449d92d69c51a605225410f46f9.exe
2360	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

9e1d9449d92d69c51a605225410f46f9.execmd.exe

description	pid	process	target process
PID 1456 wrote to memory of 2360	1456	9e1d9449d92d69c51a605225410f46f9.exe	cmd.exe
PID 1456 wrote to memory of 2360	1456	9e1d9449d92d69c51a605225410f46f9.exe	cmd.exe
PID 1456 wrote to memory of 2360	1456	9e1d9449d92d69c51a605225410f46f9.exe	cmd.exe
PID 1456 wrote to memory of 2360	1456	9e1d9449d92d69c51a605225410f46f9.exe	cmd.exe
PID 2360 wrote to memory of 4848	2360	cmd.exe	9e1d9449d92d69c51a605225410f46f9.exe
PID 2360 wrote to memory of 4848	2360	cmd.exe	9e1d9449d92d69c51a605225410f46f9.exe
PID 2360 wrote to memory of 4848	2360	cmd.exe	9e1d9449d92d69c51a605225410f46f9.exe

C:\Users\Admin\AppData\Local\Temp\8fdcdbae

Filesize
1004KB

MD5
c786946b08eb0730a7bcd6a89ab3717f

SHA1
4dc9343bfa3f56532e0c83f9a9d2eec45dc6aca8

SHA256
dd67361dce6acb2b35ca829fcf0c78a5266743474ec46f1d103894c328a28fcf

SHA512
04589b6c15cf0c794d2a75df77c8fde27d2e45fa42be54a300a92b410fb694ab3080d31551496e99fe30c43116e4d1d86d141f5bdc9bbab85c707b96c4abdd0d

Download Submit
memory/1456-0-0x00007FF64DFE0000-0x00007FF64E13F000-memory.dmp

Filesize
1.4MB

Download
memory/1456-1-0x00007FFAC23E0000-0x00007FFAC2552000-memory.dmp

Filesize
1.4MB

Download
memory/1456-2-0x00007FFAC23E0000-0x00007FFAC2552000-memory.dmp

Filesize
1.4MB

Download
memory/1456-3-0x00007FFAC23E0000-0x00007FFAC2552000-memory.dmp

Filesize
1.4MB

Download
memory/2360-6-0x00007FFAD1670000-0x00007FFAD1865000-memory.dmp

Filesize
2.0MB

Download
memory/2360-8-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/2360-9-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/2360-11-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/4848-12-0x00007FF7375D0000-0x00007FF73762A000-memory.dmp

Filesize
360KB

Download
memory/4848-14-0x00007FF7375D0000-0x00007FF73762A000-memory.dmp

Filesize
360KB

Download
memory/4848-15-0x00007FF64DFE0000-0x00007FF64E13F000-memory.dmp

Filesize
1.4MB

Download