46c3be1ef5ed88841e80c2dba54c01e220bd9f33913c86e039e242d3aeb0f8c7

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 05:42

Target

86146458c21ebd0651b9fae2d03ae87e.exe
Size

52KB
MD5

86146458c21ebd0651b9fae2d03ae87e
SHA1

83fbf77ee3fad8476d3bf9b4c618935653fe808d
SHA256

46c3be1ef5ed88841e80c2dba54c01e220bd9f33913c86e039e242d3aeb0f8c7
SHA512

1045546e527e565eee1e27b3a266b9d7d6a770260785039b3fddf5828c72042dd40951dcac3540144e1b42366f6c6da7e3b078607a412007cc66262d0b9619d0
SSDEEP

768:vMPpihV2Ont0+0bnAJZG6+DZmmWjsrmcQiXRzitdYczZUEGUqxmyq7k:vyfOt0+EATGrYrjsrTRoH921myq7

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0uupgw0.exe	86146458c21ebd0651b9fae2d03ae87e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0uupgw0.exe	86146458c21ebd0651b9fae2d03ae87e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	86146458c21ebd0651b9fae2d03ae87e.exe
876	86146458c21ebd0651b9fae2d03ae87e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84
PID 1216 wrote to memory of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84
PID 1216 wrote to memory of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84
PID 1216 wrote to memory of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84
PID 1216 wrote to memory of 876	1216	86146458c21ebd0651b9fae2d03ae87e.exe	84
PID 876 wrote to memory of 3460	876	86146458c21ebd0651b9fae2d03ae87e.exe	32
PID 876 wrote to memory of 3460	876	86146458c21ebd0651b9fae2d03ae87e.exe	32
PID 876 wrote to memory of 3460	876	86146458c21ebd0651b9fae2d03ae87e.exe	32

memory/876-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/876-9-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1216-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1216-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1216-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1216-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1216-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1216-6-0x000000005F000000-0x000000005F011000-memory.dmp

Filesize
68KB

Download