b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 04:41

Target

b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
Size

3.2MB
MD5

c351220731cb7d35f4d317c881dc33b8
SHA1

bcc87b2e47bfe4b0a7de07516c4bd1f81487393f
SHA256

b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e
SHA512

f8d26620badf8869038a7f228a24f60caca6dacf9c8ee8a230005700be5682167db021e7a16326b0ecee8673d364b006118e38663ea153fc19effcefb42ba40a
SSDEEP

98304:UIZbv/uBySU1HhAp7r+X5t0dVBTktDUAFkzuug2:UgXc+30dXkt+z7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24
PID 4804 wrote to memory of 5008	4804	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	24

C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
"C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
  "C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe"
  2⤵
  PID:5008

memory/4804-4-0x0000000004FC0000-0x00000000056EE000-memory.dmp

Filesize
7.2MB

Download
memory/4804-1-0x0000000004CA0000-0x0000000004FB5000-memory.dmp

Filesize
3.1MB

Download
memory/5008-2-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-5-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-8-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-9-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-10-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-6-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-7-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/5008-11-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download