efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 08:55

Target

efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe
Size

5.6MB
MD5

608321f2d1044c6c22eeb66205e53650
SHA1

3918051ba89f9a1a0c3116029ca554cbf80a1281
SHA256

efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756
SHA512

aecad75ff510730f7c0ed3f5f260a4697eebdea2b4c292ee0da34ff32702ed6b6511e374bd707be40dd51b9b498af4534237adc09451f658fa5aba3ca6b23e4e
SSDEEP

49152:YzmL+zbXEoqq1OQmf/csUgUk0WgwH20j9e7Esrp4AjE5EjwMh49cA0fAVXr15Tdy:YmLEbMIqPH20RvEW3TY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe

description pid process target process

PID 3840 set thread context of 1116 3840 efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe BitLockerToGo.exe

description	pid	process	target process
PID 3840 set thread context of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe

description	pid	process	target process
PID 3840 wrote to memory of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe
PID 3840 wrote to memory of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe
PID 3840 wrote to memory of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe
PID 3840 wrote to memory of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe
PID 3840 wrote to memory of 1116	3840	efa8c6ecd88a7c400ff0b28ec7e5d2052943546f4c41dc41c3702dc73e9d0756.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:1116

memory/1116-5-0x0000000000E00000-0x0000000000E58000-memory.dmp

Filesize
352KB

Download
memory/1116-9-0x0000000000E00000-0x0000000000E58000-memory.dmp

Filesize
352KB

Download
memory/1116-8-0x0000000000E00000-0x0000000000E58000-memory.dmp

Filesize
352KB

Download
memory/3840-2-0x00007FF629CD0000-0x00007FF62A2D0000-memory.dmp

Filesize
6.0MB

Download
memory/3840-6-0x00007FF629CD0000-0x00007FF62A2D0000-memory.dmp

Filesize
6.0MB

Download