a6bf3911b0e15a974b668c2a113b6c75825411213e4fa3bb5fc8b478cfce6535

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/08/2022, 12:31

Target
48f436db20e7a18c04ad55a9bf6960a0.exe
Size 368KB
Sample220823-pp2emsefej
SHA256 a6bf3911b0e15a974b668c2a113b6c75825411213e4fa3bb5fc8b478cfce6535
MD5 48f436db20e7a18c04ad55a9bf6960a0
SHA1 10a788be618e792451ab82bc6741a015c5f001c2
SHA512 1d24ab1d50b8c94d52ab038c7fb7d40f80fd951ee5e96cbbc4b334875f37addcc1336cb2bbdd0bd9e520d033ec5a0f312f20d83e4d635d02608e70abdb1aa840
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28
PID 800 wrote to memory of 1980	800	48f436db20e7a18c04ad55a9bf6960a0.exe	28

C:\Users\Admin\AppData\Local\Temp\48f436db20e7a18c04ad55a9bf6960a0.exe
"C:\Users\Admin\AppData\Local\Temp\48f436db20e7a18c04ad55a9bf6960a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\48f436db20e7a18c04ad55a9bf6960a0.exe
  "C:\Users\Admin\AppData\Local\Temp\48f436db20e7a18c04ad55a9bf6960a0.exe"
  2⤵
  PID:1980

memory/800-56-0x00000000008EB000-0x0000000000917000-memory.dmp

Download

memory/800-58-0x00000000002B0000-0x00000000002F9000-memory.dmp

Download

memory/1980-54-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/1980-59-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/1980-60-0x0000000075521000-0x0000000075523000-memory.dmp

Download

memory/1980-61-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/1980-62-0x0000000000400000-0x000000000045D000-memory.dmp

Download