701607597adc3999cb756b5e5205febaf4698ce20a3604e6ad79e49dfd060671

Analysis

Target
Payment.exe
Size 650KB
Sample201217-yzlbachfys
SHA256 701607597adc3999cb756b5e5205febaf4698ce20a3604e6ad79e49dfd060671
MD5 c576f125bb9e20097298d58c1f9fa96e
SHA1 15d2a4031e5b267cffa905f67b441cb2cc667c23
SHA512 eeffd18295d776a6b760f41b0ea35f75e485adf0d9f6414c5137139fe83981ddbfe79ae9607ff3a75adedb0a3e53dbbbeb437e35b92fa9c3d64a8880a902052c
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 536	1944	Payment.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 1944 wrote to memory of 536	1944	Payment.exe	29
PID 536 wrote to memory of 1084	536	Payment.exe	30
PID 536 wrote to memory of 1084	536	Payment.exe	30
PID 536 wrote to memory of 1084	536	Payment.exe	30
PID 536 wrote to memory of 1084	536	Payment.exe	30

memory/536-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/536-4-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/536-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1084-7-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

Download

memory/1084-10-0x0000000002380000-0x0000000002391000-memory.dmp

Download