09322bf887635343f0c9e61b8b302bb56f50eb0f01cb37e14e9fabff91addd94

Analysis

max time kernel
147s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
29/06/2024, 20:41

Target

qeUaxJCA3FO.exe
Size

598KB
MD5

47c2be5511f85eea87d60087a2295101
SHA1

688a4b4e3bc01bee9e77d8520cf45743573f46a4
SHA256

b2f49f0484068d893545562b47fdb527299dce02c70fe7c99c1aec82310c9953
SHA512

bbe2b4706a3431bb373d88e0548fa92e72b2cbbde86fc0c3f2523fe2492ac3f4b9697c1f8bad27e32595181a4fa7cb381bbe11e9a456903c725870cfaf1fa65c
SSDEEP

12288:25oKL1f7G8fKjtqlWtICj+mkcrnRdhoTkTRqMZAC93sdEO:2VLv8qlYfkMPZX9kt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 4388	2448	qeUaxJCA3FO.exe	79

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79
PID 2448 wrote to memory of 4388	2448	qeUaxJCA3FO.exe	79

C:\Users\Admin\AppData\Local\Temp\qeUaxJCA3FO.exe
"C:\Users\Admin\AppData\Local\Temp\qeUaxJCA3FO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4388

memory/2448-0-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4388-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4388-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4388-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4388-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download