563221da661e5ee5abc6ed955efb72e21b7c3563a14ece313ee4ff546c92eb3e

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 01:01

Target

858455321bd8c12c19b69f6835ed69f0.exe
Size

209KB
MD5

858455321bd8c12c19b69f6835ed69f0
SHA1

b0fc0075745d9f03e79b6e8fb7b7b4401b927d78
SHA256

563221da661e5ee5abc6ed955efb72e21b7c3563a14ece313ee4ff546c92eb3e
SHA512

02cc26669af34b636696b6e9fa4de97579f581e43a1b458ae3cb8754d6de260c311190b71aa390888658f12ca8974175e5f5e4e8f4bd56c35fe198677bee6193
SSDEEP

3072:PABKe7+p5XBAbF8ZQ/QEnRu5k4m5VZobn8PC4999PAD5LcAFpNnxdMQxgS+gTre5:uVTfo7g9jP6pOQxgSKVq+rL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

858455321bd8c12c19b69f6835ed69f0.exe

description pid process target process

PID 1100 set thread context of 3924 1100 858455321bd8c12c19b69f6835ed69f0.exe 858455321bd8c12c19b69f6835ed69f0.exe

description	pid	process	target process
PID 1100 set thread context of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

858455321bd8c12c19b69f6835ed69f0.exe

description	pid	process	target process
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe
PID 1100 wrote to memory of 3924	1100	858455321bd8c12c19b69f6835ed69f0.exe	858455321bd8c12c19b69f6835ed69f0.exe

C:\Users\Admin\AppData\Local\Temp\858455321bd8c12c19b69f6835ed69f0.exe
"C:\Users\Admin\AppData\Local\Temp\858455321bd8c12c19b69f6835ed69f0.exe"
2⤵
PID:3924

memory/1100-0-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/1100-1-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/3924-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3924-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3924-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3924-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download