d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 12:34

Target
SecuriteInfo.com.Variant.Zusy.435740.24183.exe
Size 230KB
Sample220817-prrm8afeel
SHA256 d07727be5c28ccfe3d1af3582d2a29f5b04b3a6d021ec4bd38ed6bbfa3ebb5cc
MD5 e7ca0eebc8e2075a87e023aaff15b2cd
SHA1 6ef12272209426b46d8cacc57b2f06f7066f8de8
SHA512 b6d66c1e0a5f86574729f8aea586287bbba1c5ce2492f8fbf6616aaca61478710bd4a6899b4e6ee866b735d80dd5b58a9f58c7c4fd2ac1182fb70c91231bd14f
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83
PID 2512 wrote to memory of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83
PID 2512 wrote to memory of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83
PID 2512 wrote to memory of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83
PID 2512 wrote to memory of 4632	2512	SecuriteInfo.com.Variant.Zusy.435740.24183.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.24183.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.435740.24183.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4632

memory/2512-141-0x0000000000DB0000-0x0000000000DED000-memory.dmp

Download

memory/4632-133-0x0000000000140000-0x0000000000152000-memory.dmp

Download

memory/4632-140-0x0000000000140000-0x0000000000152000-memory.dmp

Download