8795b15a553d848081369ce5b1ad4e1ca140a8f6cf958804860600f8e089da15

Analysis

max time kernel
189s
max time network
457s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 17:40

Target

Solution.exe
Size

4.1MB
MD5

bfac754cad1bc454d652398dc1020df2
SHA1

a08ba59970f80c981c25455c41ea86c2458b23c4
SHA256

8795b15a553d848081369ce5b1ad4e1ca140a8f6cf958804860600f8e089da15
SHA512

51b6b1b68b2c9758c6211d418bbf7dc57b11b2eff7bb11ced0b44d62f2c9686ea47607f3f558665a4589e9f4294db40d1c9b05db522e0a97e9d69809b069cbc6
SSDEEP

98304:sYTLCic1OtXCvgJ7EmWizL8YpURoOZBvMGrO+I3W:E4tSvgpEmodoOZBvlqbm

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2376	Solution.exe
2376	Solution.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2376	Solution.exe
2376	Solution.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2376	Solution.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 544	2376	Solution.exe	91
PID 2376 wrote to memory of 544	2376	Solution.exe	91

C:\Users\Admin\AppData\Local\Temp\Solution.exe
"C:\Users\Admin\AppData\Local\Temp\Solution.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color e
  2⤵
  PID:544

memory/2376-0-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download
memory/2376-2-0x00007FFF48DB0000-0x00007FFF48DB2000-memory.dmp

Filesize
8KB

Download
memory/2376-3-0x00007FFF48DC0000-0x00007FFF48DC2000-memory.dmp

Filesize
8KB

Download
memory/2376-4-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download
memory/2376-8-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2376-9-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2376-10-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2376-12-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/2376-13-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/2376-11-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/2376-14-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2376-15-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2376-16-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/2376-17-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2376-18-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download