9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
05/06/2024, 18:02

Target
9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe
Size 529KB
Sample240605-wmtqcaef28
SHA256 9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0
MD5 8093f9f76f04709789c68a458101a4ce
SHA1 00a793230423a7db3d812aa7a49fd4eb7fdf76e8
SHA512 ff78c782db1e274d340ef6e07bf6a39c3fe615f865c0c3460b4b1a3c07e6c6ba29639c21642029c3ff9d2adfe3335746b9b66947fdbb15dd6d93fcda10b66177
SSDEEP 12288:747uBH9l0YZloolb2yz9EsMvXZYn+xWh2UV:747+ldUkbTSZP26Wh2g
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77
PID 1252 wrote to memory of 1100	1252	9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe	77

C:\Users\Admin\AppData\Local\Temp\9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe
"C:\Users\Admin\AppData\Local\Temp\9cde28aa663b57630021fe332673ebbc6265dd5d2117dfc7264e3cf0529459b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1100

memory/1100-1-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1100-5-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1100-6-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1100-7-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1252-0-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/1252-3-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download