0050ab6912e9c63bb65930ef52094fca855f8dab9210f74b1d9e2c6c61c9d5b0

Analysis

max time kernel
147s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/08/2022, 10:38

Target
SecuriteInfo.com.Variant.Lazy.234899.9452.exe
Size 242KB
Sample220817-mpdbpsedbk
SHA256 0050ab6912e9c63bb65930ef52094fca855f8dab9210f74b1d9e2c6c61c9d5b0
MD5 2e5c72685c3013eeae753e2dce644069
SHA1 12900307b7d9a8f2d6cefce83990d159640ff4bd
SHA512 d0a2417ee1705cbadeea420aaaa24a633eeacee28630ae8863305b05830e329e6e83fe7fe7e07b21f1caadb2b36b31512242172289f08a047cca91666b65170a
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28
PID 1988 wrote to memory of 1632	1988	SecuriteInfo.com.Variant.Lazy.234899.9452.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.9452.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.234899.9452.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1632

memory/1632-54-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1632-56-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1632-64-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1632-66-0x00000000761F1000-0x00000000761F3000-memory.dmp

Download

memory/1988-65-0x0000000000B80000-0x0000000000BBF000-memory.dmp

Download