4d9de5cd527ffa7495f5b7e45f99a879c8453f58d0a3f7b42c476cfd87a1b62f

Analysis

Target
Ref344200.exe
Size 1.1MB
Sample210209-61cdr533ds
SHA256 4d9de5cd527ffa7495f5b7e45f99a879c8453f58d0a3f7b42c476cfd87a1b62f
MD5 a488dedd2c71ff9455dff50479dfc62b
SHA1 1da11ef72a1e9b360799c6039ba9dfe91e0b8368
SHA512 f966f510fd4403cd1e83addc9e26fb08df600f1e78cb79e4d31d5ed0fdd568904831e95fa4f504bd18f338c35977eb70cc33f7aaac6d3d0cb7c30f1ed17cc03d
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 2016	1048	Ref344200.exe	79

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79
PID 1048 wrote to memory of 2016	1048	Ref344200.exe	79

C:\Users\Admin\AppData\Local\Temp\Ref344200.exe
"C:\Users\Admin\AppData\Local\Temp\Ref344200.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  PID:2016

memory/1048-2-0x0000000002B60000-0x0000000002B61000-memory.dmp

Download

memory/2016-3-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2016-5-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download

memory/2016-6-0x00000000015C1000-0x00000000015C2000-memory.dmp

Download