8795b15a553d848081369ce5b1ad4e1ca140a8f6cf958804860600f8e089da15

Analysis

max time kernel
216s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2024, 17:40

Target

Solution.exe
Size

4.1MB
MD5

bfac754cad1bc454d652398dc1020df2
SHA1

a08ba59970f80c981c25455c41ea86c2458b23c4
SHA256

8795b15a553d848081369ce5b1ad4e1ca140a8f6cf958804860600f8e089da15
SHA512

51b6b1b68b2c9758c6211d418bbf7dc57b11b2eff7bb11ced0b44d62f2c9686ea47607f3f558665a4589e9f4294db40d1c9b05db522e0a97e9d69809b069cbc6
SSDEEP

98304:sYTLCic1OtXCvgJ7EmWizL8YpURoOZBvMGrO+I3W:E4tSvgpEmodoOZBvlqbm

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1760	Solution.exe
1760	Solution.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	Solution.exe
1760	Solution.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1760	Solution.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4596	1760	Solution.exe	82
PID 1760 wrote to memory of 4596	1760	Solution.exe	82

C:\Users\Admin\AppData\Local\Temp\Solution.exe
"C:\Users\Admin\AppData\Local\Temp\Solution.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color e
  2⤵
  PID:4596

memory/1760-0-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download
memory/1760-2-0x00007FFD13D90000-0x00007FFD13D92000-memory.dmp

Filesize
8KB

Download
memory/1760-3-0x00007FFD13DA0000-0x00007FFD13DA2000-memory.dmp

Filesize
8KB

Download
memory/1760-4-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download
memory/1760-8-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1760-9-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/1760-10-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/1760-11-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1760-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1760-15-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1760-14-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1760-12-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/1760-16-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/1760-17-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/1760-18-0x0000000140000000-0x000000014080F000-memory.dmp

Filesize
8.1MB

Download