20c95e3149be72b8562994652bbf6e72395564a13ea6201b7ab1c3dbcfe521ba

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 06:40

Target

98bca35936634479280fc704e74e9652.exe
Size

42KB
MD5

98bca35936634479280fc704e74e9652
SHA1

4c5c736f704d7f0de9364c9f2d07354a7a55ae1c
SHA256

20c95e3149be72b8562994652bbf6e72395564a13ea6201b7ab1c3dbcfe521ba
SHA512

1c8e850a3b8a834f16c3cfc0cc9072df79e05fdec0029d921bbbe4124e2a29d44c478943cea09fb754cfb27136c43e01357d688a21dba73dfcba1430eeafdf0a
SSDEEP

768:0zIXe/KSYbzMi5dIskLYthbpI+zIXX+U6bvYHuSlkgWCAK6T6pt:MI6KSYbzMifk6hbpM6LYO7DPK6Tc

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3kkfwwr.exe	98bca35936634479280fc704e74e9652.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3kkfwwr.exe	98bca35936634479280fc704e74e9652.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3512 set thread context of 3012	3512	98bca35936634479280fc704e74e9652.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3012	98bca35936634479280fc704e74e9652.exe
3012	98bca35936634479280fc704e74e9652.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3012	3512	98bca35936634479280fc704e74e9652.exe	85
PID 3512 wrote to memory of 3012	3512	98bca35936634479280fc704e74e9652.exe	85
PID 3512 wrote to memory of 3012	3512	98bca35936634479280fc704e74e9652.exe	85
PID 3512 wrote to memory of 3012	3512	98bca35936634479280fc704e74e9652.exe	85
PID 3512 wrote to memory of 3012	3512	98bca35936634479280fc704e74e9652.exe	85
PID 3012 wrote to memory of 3504	3012	98bca35936634479280fc704e74e9652.exe	44
PID 3012 wrote to memory of 3504	3012	98bca35936634479280fc704e74e9652.exe	44
PID 3012 wrote to memory of 3504	3012	98bca35936634479280fc704e74e9652.exe	44

memory/3012-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3012-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3512-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3512-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download