a7e9be368fe2c4c7d2da2fde1477695f64efe8f52ae46110c7bb4426e04c4151

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:27

Target

60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe
Size

36KB
MD5

64d5c423143bae1f0c5919d2400d9c61
SHA1

34941d045464341786088e3aefe2f8e307f9c15d
SHA256

60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da
SHA512

5e888cd8d1cfc30dcb1c398c28c0abe0e8655370a3d47e52e8fbc3ee28e564cad105cad5fff6d7a94965a84be7e04dae6c3532898b99eb2afe1b2441c1c61dfa
SSDEEP

768:z3yncg3CD1GBVBUIi1yOwtdw4fCa1Qi+07vg92w:ucg3RUIiMOwtdwOrI9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4232	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 4232	4860	60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe	84

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4232	4860	60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe	84
PID 4860 wrote to memory of 4232	4860	60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe	84
PID 4860 wrote to memory of 4232	4860	60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe	84
PID 4860 wrote to memory of 4232	4860	60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe	84

C:\Users\Admin\AppData\Local\Temp\60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe
"C:\Users\Admin\AppData\Local\Temp\60b1b3a69ff7db07dfe4baf4d1ef65ba961e5fb15000ba8b6b24f602bad1b3da.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Deletes itself
  PID:4232

memory/4232-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4860-3-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/4860-2-0x00000000004A0000-0x00000000004A3000-memory.dmp

Filesize
12KB

Download
memory/4860-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download