4d010b1ff21191067838ca4b5f593bfc06900823851b5e1eea4f1c269b29d271

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 14:59

Target

upload.exe
Size

638KB
MD5

a4e38bef52cdd304fc8efbb9933cae8e
SHA1

0caadb6512a2797d5b99047b44fab1e45084a91c
SHA256

4d010b1ff21191067838ca4b5f593bfc06900823851b5e1eea4f1c269b29d271
SHA512

7e6b5d6e24e4f27d5586f5a145ee065a6b1734f067ce32f73b74795ffa6367b67560ee853f48801ff18530cf42c745294bbe0818129c6f8fec184646357c91e2
SSDEEP

12288:y/Q+IIXkiPjpLr5pvId4i1qyR44I2eZrnln5n+b/Myjo4xrMnzpB9k:ZVWTiRqyR44INplnsbhj/xrMzv9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 4748	2860	upload.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83
PID 2860 wrote to memory of 4748	2860	upload.exe	83

C:\Users\Admin\AppData\Local\Temp\upload.exe
"C:\Users\Admin\AppData\Local\Temp\upload.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4748

memory/2860-6-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/2860-0-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/2860-2-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/2860-3-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/2860-4-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/2860-8-0x00000000752A0000-0x0000000075A50000-memory.dmp

Filesize
7.7MB

Download
memory/2860-1-0x0000000000A90000-0x0000000000B36000-memory.dmp

Filesize
664KB

Download
memory/4748-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4748-12-0x00000000011A0000-0x00000000011D2000-memory.dmp

Filesize
200KB

Download
memory/4748-11-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4748-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/4748-13-0x00000000011A0000-0x00000000011D2000-memory.dmp

Filesize
200KB

Download
memory/4748-14-0x00000000011A0000-0x00000000011D2000-memory.dmp

Filesize
200KB

Download
memory/4748-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download