6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03-07-2024 15:14

Target

6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe
Size

4.9MB
MD5

2502f2fb88c1ea569c0b4287ae0613f3
SHA1

aae526d8ce17f59366b57d5d00ab5d14140cd6b5
SHA256

6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513
SHA512

7c0e3a6f8322aafa90533bcd2ff5ab2b167ef7c1c8412710c4b3a3b4643cdb0412cf93c561ce1c01a1057643bda336fd3fa64e3a7373d41cc25319d5190ca2d2
SSDEEP

49152:HwWM2zE1fkrLilu5l55F+QjEcEAGjz5Ep+8YTpuQynVoj28OBpclaYC4Ihign93:QWlzE1fyLi61kE7piK93

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe

description pid process target process

PID 2628 set thread context of 4940 2628 6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe BitLockerToGo.exe

description	pid	process	target process
PID 2628 set thread context of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe

description	pid	process	target process
PID 2628 wrote to memory of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe
PID 2628 wrote to memory of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe
PID 2628 wrote to memory of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe
PID 2628 wrote to memory of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe
PID 2628 wrote to memory of 4940	2628	6c3496832cdffffedde13f9c75138ee62dd968eaa26bc23e1cbc082e638c3513.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4940

memory/2628-4-0x00007FF651950000-0x00007FF651E9B000-memory.dmp

Filesize
5.3MB

Download
memory/2628-6-0x00007FF651950000-0x00007FF651E9B000-memory.dmp

Filesize
5.3MB

Download
memory/4940-5-0x0000000001250000-0x00000000012A7000-memory.dmp

Filesize
348KB

Download
memory/4940-8-0x0000000001250000-0x00000000012A7000-memory.dmp

Filesize
348KB

Download
memory/4940-9-0x0000000001250000-0x00000000012A7000-memory.dmp

Filesize
348KB

Download