a282a219c85458810a6c1e367093762bf731f5309e7426235fe617bfe6c1d3c3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 18:20

Target

VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
Size

108KB
MD5

09f95bd2323574b6edeac8f8e349e4dd
SHA1

c4d51e741fe97a23d76a2e9a8df603b7dd4c026a
SHA256

a282a219c85458810a6c1e367093762bf731f5309e7426235fe617bfe6c1d3c3
SHA512

33fb8744ace2a30e698147dd7bfff5a533ae2ce04ba94a10ec973d5068ca17de0b1ac18f4a44faa18e8994ebc5cf3f4974a570b8a9a8bc3511bf713531dc5cc1
SSDEEP

1536:g9FKtQ2gO0CAiJMBRum3P33f37nZGvdHVmdduNzq3XmymL1zh2lERJf9gQYqVmmi:gCtyOtJIbovFVbJq32ymzXgQVmgAN4A/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe

description	pid	process	target process
PID 4540 set thread context of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe

description	pid	process	target process
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
PID 4540 wrote to memory of 2868	4540	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe	VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_09f95bd2323574b6edeac8f8e349e4dd.exe"
  2⤵
  PID:2868

memory/2868-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-10-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2868-9-0x0000000001ED0000-0x0000000001EF1000-memory.dmp

Filesize
132KB

Download
memory/2868-8-0x0000000077DB2000-0x0000000077DB3000-memory.dmp

Filesize
4KB

Download
memory/2868-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-13-0x0000000001ED0000-0x0000000001EF1000-memory.dmp

Filesize
132KB

Download