e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f100e3aca30d7ae4fd71e3

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/08/2022, 09:41

Target
e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe
Size 389KB
Sample220819-lnrx2abefj
SHA256 e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f100e3aca30d7ae4fd71e3
MD5 0f0f3d6002656a999219d947eb1f89f6
SHA1 01a438f4743978385a08a5d59400503cfb39410d
SHA512 706e7e2ed8fbc7ba72950ec60eec575bd13811d6b0e5d7daf7710ffa6d8d09c341716c3c9f4885e524978321fb5f6726fb520352cb66993200f180c41a7633b4
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29
PID 1764 wrote to memory of 1008	1764	e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe	29

C:\Users\Admin\AppData\Local\Temp\e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe
"C:\Users\Admin\AppData\Local\Temp\e93c5c2ba1c82039ae7db7deac58da2ce78ef28c58f10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1008

memory/1008-54-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1008-56-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1008-64-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1008-65-0x0000000076261000-0x0000000076263000-memory.dmp

Download

memory/1764-66-0x0000000000360000-0x00000000003C4000-memory.dmp

Download