299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2

Analysis

Target

299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
Size

3.4MB
MD5

7b0115f236b1768d9d56b9349a9d2ff8
SHA1

123764b322852fec5058697f9559105154bda128
SHA256

299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2
SHA512

4585ece8de3bf8a826103af6b1814e758a90e580bae34fd80f2489061cf3ac884117c43d50ab5eafec9625a0fa23968b08a04a8f90aa9f8d4c00bbe4575692d5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

description	pid	process	target process
PID 1032 set thread context of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

pid process

1032 299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

pid	process
1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

description	pid	process	target process
PID 1032 wrote to memory of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
PID 1032 wrote to memory of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
PID 1032 wrote to memory of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
PID 1032 wrote to memory of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
PID 1032 wrote to memory of 988	1032	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe	299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe

C:\Users\Admin\AppData\Local\Temp\299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe
"C:\Users\Admin\AppData\Local\Temp\299942c2a7a827739ac1a5c700a24c4232d6d7337cafa5a305f3114b1fca83d2.exe"
2⤵
PID:988

memory/988-58-0x00000000004CEEB0-mapping.dmp

Download
memory/988-59-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/988-60-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/988-61-0x0000000000400000-0x0000000000746000-memory.dmp

Filesize
3.3MB

Download
memory/1032-54-0x00000000027B0000-0x0000000002AF3000-memory.dmp

Filesize
3.3MB

Download