934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7

Analysis

max time kernel
94s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:33

Target

934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
Size

1.1MB
MD5

b05203ce620abcf84ff7acb68ce49e8e
SHA1

39b0c3f649afe2e6d6e4fc4fa343e9dd19d2d66c
SHA256

934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7
SHA512

c5a33fc60b5d56844815e711e6567018cbbcb948f003d3e4406e42b498f318e75701d7e59b4ea350b7d0d8aa6158f8b68a51f229596bcb02dd161f234931ff8a
SSDEEP

24576:SAHnh+eWsN3skA4RV1Hom2KXMmHacuEoUsJ+/MM35:Vh+ZkldoPK8YacWUs8kI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2376	2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	83

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2376	2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	83
PID 2072 wrote to memory of 2376	2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	83
PID 2072 wrote to memory of 2376	2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	83
PID 2072 wrote to memory of 2376	2072	934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe	83

C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe
"C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\934b3a1cd49248b6f9dcba03284c4e3988d853f55a07ee6464cf677a584e15a7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Users\Admin\AppData\Local\Temp\aut6F63.tmp

Filesize
266KB

MD5
adf8b93c02082284280964f34d978a79

SHA1
258a804a7ce60dda487a0a9d62dfe96b73bd836b

SHA256
9606494cf7e882ba4654d06ae2dafb00793268b6ecbecac74e7245939c8d9e46

SHA512
3c991694eb63865af5e185df71852eb21bf83adf9208062ec9c5c9ecd68012b9efc10a9d24ea350f74c5a3ad70d40296679d742ba89e738d701af42e88747293

Download Submit
memory/2072-12-0x0000000001C90000-0x0000000001C94000-memory.dmp

Filesize
16KB

Download
memory/2376-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-14-0x0000000001700000-0x0000000001A4A000-memory.dmp

Filesize
3.3MB

Download
memory/2376-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download