616f5eba1eca93ac2d425b711ffd342cfce49448ac1a3b592f85cd1d45fe69de

Analysis

max time kernel
91s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 20:00

Target

9558fca2b182f491a45249a3cfb547d4.exe
Size

167KB
MD5

9558fca2b182f491a45249a3cfb547d4
SHA1

fcc612bba8103f25c2f88cdada4ad813f3a11f93
SHA256

616f5eba1eca93ac2d425b711ffd342cfce49448ac1a3b592f85cd1d45fe69de
SHA512

95dc06fae5abb3e78414e715316e7ed3fd74ebbf619722ad00e084aa20f2a2f24b978c347338c156eba123b3d1946780acb9c8e61763da2fccbe79296a836810
SSDEEP

3072:In8YlCqh9MPEADHgctNADXcEG28Hi2pDJPFb3t0JJM53eXMknGjD03y:88YVrZHctNaXc528nXR3uJM3sMDa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91

Suspicious behavior: EnumeratesProcesses 26 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91
PID 756 wrote to memory of 2388	756	9558fca2b182f491a45249a3cfb547d4.exe	91

C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe
"C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe
  "C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388

memory/756-0-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/756-2-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/756-1-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/756-3-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/756-9-0x0000000074980000-0x0000000074F31000-memory.dmp

Filesize
5.7MB

Download
memory/2388-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2388-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download