fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:16

Target

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
Size

711KB
MD5

6956630ee4efe1b3723f37e5c31bf569
SHA1

be0ed06ecd81d6782349cd2a8781596c52d4cd46
SHA256

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1
SHA512

c7035fffbcbe070506bb36701edfe0466f02c1fa2904b12ba1f7072e69aee15a55e5317f54c4f3704c9f2fce1655b6c5524d2f288a60c8b56f9f8a7edceb6464
SSDEEP

12288:Ligd6+hkpstM13N91AzHvCCQXgRwggo7liW1eIe0H2lztV6Y+yaxXog8kFeXsLhg:+e6+hv+991AzPC2DlpiW1ApXottQpu

Score

9^/10

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4080-4-0x000000001B3C0000-0x000000001B3DC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

Processes:

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

description	pid	process	target process
PID 4080 set thread context of 3880	4080	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

description	pid	process	target process
PID 4080 wrote to memory of 3880	4080	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
PID 4080 wrote to memory of 3880	4080	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
PID 4080 wrote to memory of 3880	4080	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe	fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe

C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
"C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
  C:\Users\Admin\AppData\Local\Temp\fb240bd2e7625b10a5e3ee6e5531950995de28e67cc5f0e7787d955d04416bc1.exe
  2⤵
  PID:3880

memory/4080-0-0x00007FFD234B3000-0x00007FFD234B5000-memory.dmp

Filesize
8KB

Download
memory/4080-1-0x00000000007B0000-0x0000000000866000-memory.dmp

Filesize
728KB

Download
memory/4080-2-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

Filesize
10.8MB

Download
memory/4080-3-0x000000001BF20000-0x000000001BFCC000-memory.dmp

Filesize
688KB

Download
memory/4080-4-0x000000001B3C0000-0x000000001B3DC000-memory.dmp

Filesize
112KB

Download
memory/4080-5-0x0000000002B90000-0x0000000002BA4000-memory.dmp

Filesize
80KB

Download
memory/4080-6-0x000000001C390000-0x000000001C418000-memory.dmp

Filesize
544KB

Download
memory/4080-8-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp

Filesize
10.8MB

Download