a50af9fb8e00f47b558e2f8e25de4aea67227f0b4120eaaacff3215af2c5258e

Analysis

Target
1a92e24d96100de5cf830e78515c506a.exe
Size 227KB
Sample201112-mjnyl3c34e
SHA256 a50af9fb8e00f47b558e2f8e25de4aea67227f0b4120eaaacff3215af2c5258e
MD5 1a92e24d96100de5cf830e78515c506a
SHA1 d1e6eefb34744e481155e04b0542ec8c53b5f169
SHA512 79e1400b55dd3d10cdb561a815872af81a131ca5af1837c7ef7846d23a8afe39f412f1f57d1073e6a78ee230e5563796b191338c30c6046b0e1dcbbff0fd29ce
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29
PID 1924 wrote to memory of 1588	1924	1a92e24d96100de5cf830e78515c506a.exe	29

C:\Users\Admin\AppData\Local\Temp\1a92e24d96100de5cf830e78515c506a.exe
"C:\Users\Admin\AppData\Local\Temp\1a92e24d96100de5cf830e78515c506a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\1a92e24d96100de5cf830e78515c506a.exe
  "C:\Users\Admin\AppData\Local\Temp\1a92e24d96100de5cf830e78515c506a.exe"
  2⤵
  PID:1588

memory/1588-2-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1588-4-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1588-5-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/1924-0-0x000000000317B000-0x000000000317C000-memory.dmp

Download

memory/1924-1-0x00000000047F0000-0x0000000004801000-memory.dmp

Download