6515daf821f1ba10e5de6f707423f28f48cc80149a44bbfc3331fe24b9a2c3ec

Analysis

Target
cb90480b14a1786fb675939e305d528e.exe
Size 227KB
Sample201112-5b3b7drkps
SHA256 6515daf821f1ba10e5de6f707423f28f48cc80149a44bbfc3331fe24b9a2c3ec
MD5 cb90480b14a1786fb675939e305d528e
SHA1 195b11626b81f99c6af1a81d8b8b3db10cc65f78
SHA512 43cd1987417ef1ffc68a2adc5d3d69329eabe36772d4fda0ab361a40ac153bae45dcc9bf9c0484a7cf383f5b465f09017b3c9c2e7e94fd40b4bdc32f6f70ef60
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 764 set thread context of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29
PID 764 wrote to memory of 1360	764	cb90480b14a1786fb675939e305d528e.exe	29

C:\Users\Admin\AppData\Local\Temp\cb90480b14a1786fb675939e305d528e.exe
"C:\Users\Admin\AppData\Local\Temp\cb90480b14a1786fb675939e305d528e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\cb90480b14a1786fb675939e305d528e.exe
  "C:\Users\Admin\AppData\Local\Temp\cb90480b14a1786fb675939e305d528e.exe"
  2⤵
  PID:1360

memory/764-0-0x000000000316B000-0x000000000316C000-memory.dmp

Download

memory/764-1-0x0000000004990000-0x00000000049A1000-memory.dmp

Download

memory/1360-2-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1360-4-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1360-5-0x00000000001B0000-0x00000000001E3000-memory.dmp

Download