e03518acef8a2fecee311fac04e11943e8b219815f02224a4ae30d5ecccf0f90

Analysis

max time kernel
212s
max time network
275s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
26/05/2024, 22:18

Target

crypted.exe
Size

519KB
MD5

1b1c7e6e96667a6a758b22d444de57a7
SHA1

3eafd122d0814ee5aeb35a9bce975805a8cf6744
SHA256

e03518acef8a2fecee311fac04e11943e8b219815f02224a4ae30d5ecccf0f90
SHA512

2ed665526ec20b8c3d8a6854e25bcf44755e4bfd8f34b3770c3694e4b9cd8b2ad85d130830cb298aa18521f30038ef47e5d93225a5eb14039670f5ef626f91f7
SSDEEP

12288:ar9mi27cWO4AEcI9cCHEAJtv9QXmuP16k:6mfemcCflO1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 1004	2660	crypted.exe	78

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4984	2660	crypted.exe	77
PID 2660 wrote to memory of 4984	2660	crypted.exe	77
PID 2660 wrote to memory of 4984	2660	crypted.exe	77
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78
PID 2660 wrote to memory of 1004	2660	crypted.exe	78

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1004

memory/1004-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1004-5-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1004-6-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1004-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2660-0-0x0000000001500000-0x0000000001501000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x0000000001500000-0x0000000001501000-memory.dmp

Filesize
4KB

Download
memory/2660-3-0x0000000001500000-0x0000000001501000-memory.dmp

Filesize
4KB

Download