parallax | 2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af

Analysis

Target

2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
Size

740KB
MD5

18551ecce3d3f037804002709354d12c
SHA1

0121223d675ac59d22e27efc5f0ce2d456c03bb0
SHA256

2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af
SHA512

ff15a0b891a587e33b4a8334cbcdfb12a875660bc8c87d50751c3b38e4491d7d41b1be6383b671c7fd238211f14bbaf145963c5bd2581773344e1e2250b6a83f

Score

10^/10

parallax rat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 1092	552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1092	552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe	28
PID 552 wrote to memory of 1092	552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe	28
PID 552 wrote to memory of 1092	552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe	28
PID 552 wrote to memory of 1092	552	2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe	28

C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
"C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe
  "C:\Users\Admin\AppData\Local\Temp\2622016be39fe49f9bc20e8cbae6f330523b7abef9c4f7cf9d8fabc7f30542af.exe"
  2⤵
  PID:1092

memory/552-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/552-55-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download