18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82

Analysis

max time kernel
0s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 02:57

Target

18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe
Size

3.2MB
MD5

3dbe4ac28b0a380239d273eaff23ace9
SHA1

ede55de16d4e99f85215ae96bbae4c1a79c893f8
SHA256

18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82
SHA512

6d56bd98284479fe813a4d78e1206d8e24de7eb8e22cf514f47b6c0639ff7f68826c9a7f79d96a4e397b1f7a98252f73bbf86fbc5908d97479e430e5c1f1adc3
SSDEEP

98304:IIpr4aPO5QTdjkYR9tNDrMoyUH5va0bRthYcjmV:IArTd1rH5va0bRsci

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4396 set thread context of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20
PID 4396 wrote to memory of 4192	4396	18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe	20

C:\Users\Admin\AppData\Local\Temp\18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe
"C:\Users\Admin\AppData\Local\Temp\18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe
  "C:\Users\Admin\AppData\Local\Temp\18e3b45774ac1a34b1addea07e6fe91a3f74f204007ca00c85f5a9cbad8cad82.exe"
  2⤵
  PID:4192

memory/4192-5-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-6-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-7-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-9-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-10-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-8-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-2-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4192-11-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/4396-3-0x0000000002A10000-0x000000000313E000-memory.dmp

Filesize
7.2MB

Download
memory/4396-1-0x00000000026F0000-0x0000000002A03000-memory.dmp

Filesize
3.1MB

Download