d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/08/2022, 12:34

Target
SecuriteInfo.com.Variant.Zusy.435740.24183.exe
Size 230KB
Sample220817-prrm8afeel
SHA256 d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc
MD5 e7ca0eebc8e2075a87e023aaff15b2cd
SHA1 6ef12272209426b46d8cacc57b2f06f7066f8de8
SHA512 b6d66c1e0a5f86574729f8aea586287bbba1c5ce2492f8fbf6616aaca61478710bd4a6899b4e6ee866b735d80dd5b58a9f58c7c4fd2ac1182fb70c91231bd14f
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1208 set thread context of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27
PID 1208 wrote to memory of 1620	1208	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.24183.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.24183.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1620

memory/1208-65-0x0000000000300000-0x000000000033D000-memory.dmp

Download

memory/1620-54-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/1620-56-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/1620-64-0x0000000000090000-0x00000000000A2000-memory.dmp

Download

memory/1620-66-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download

memory/1620-67-0x0000000000090000-0x00000000000A2000-memory.dmp

Download