c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10-07-2024 05:54

Target

c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe
Size

8.6MB
MD5

0e9459f87d4d72ca3f3fb54af7432de9
SHA1

8941d42eb6f891aca9652cb3cbcdefc547a0ee1c
SHA256

c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44
SHA512

4b646775910d27e0c8b410a0e7e8b5b05f63839a6c26ee25952a27740688db4029916a6fb88e70accfab239f5eab532ae169f7146cdb093f826162b46689c728
SSDEEP

49152:4kmANd/Zz39voeJAg/Bst+YhOQz4W3FlFPyHF80WBh5OIm/tJe34jcH5EGgMLhZk:Uoh3FJBWz4W1lFbBnPE6wUa7nPF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5732 set thread context of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78
PID 5732 wrote to memory of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78
PID 5732 wrote to memory of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78
PID 5732 wrote to memory of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78
PID 5732 wrote to memory of 3196	5732	c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe	78

C:\Users\Admin\AppData\Local\Temp\c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe
"C:\Users\Admin\AppData\Local\Temp\c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3196

memory/3196-5-0x0000000000150000-0x000000000019F000-memory.dmp

Filesize
316KB

Download
memory/3196-8-0x0000000000150000-0x000000000019F000-memory.dmp

Filesize
316KB

Download
memory/3196-9-0x0000000000150000-0x000000000019F000-memory.dmp

Filesize
316KB

Download
memory/3196-10-0x0000000000150000-0x000000000019F000-memory.dmp

Filesize
316KB

Download
memory/5732-4-0x00007FF7DD1D0000-0x00007FF7DDB07000-memory.dmp

Filesize
9.2MB

Download
memory/5732-6-0x00007FF7DD1D0000-0x00007FF7DDB07000-memory.dmp

Filesize
9.2MB

Download