d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf

Analysis

max time kernel
51s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 10:59

Target

SecuriteInfo.com.Win32.PWSX-gen.5781.exe
Size

1.1MB
MD5

bb4439a0da57a429dbfb44e37ca69443
SHA1

b85dbd7083b26e45b11e278fd5165d18fc547586
SHA256

d0294bc11b1c8e0655189aba2ade4ffb54da6f36e2afc2ef2e0045a5a17203bf
SHA512

b9e76a5d5492026f7f79f1e4bda06ef666c916cc7c8be57666f8c20b56401367dc7722397ed8d5cef17d9106bb49087ee900810c15b660447cd558c039fd9c1a
SSDEEP

12288:Lpj9Pvq8GH3BaAxvkb+c/qx2Q4BWCvKqF2Yk0woqSTp384QFTC6LgGDpGfC:L/tGXBtWCOd/bKqFjkjoqKpSZvpGfC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1136	SecuriteInfo.com.Win32.PWSX-gen.5781.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28
PID 1440 wrote to memory of 1136	1440	SecuriteInfo.com.Win32.PWSX-gen.5781.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5781.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136

memory/1136-60-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1136-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1136-63-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1136-66-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1136-67-0x0000000000401000-0x000000000042D000-memory.dmp

Filesize
176KB

Download
memory/1136-68-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/1440-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1440-56-0x0000000000740000-0x000000000075A000-memory.dmp

Filesize
104KB

Download
memory/1440-57-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/1440-58-0x0000000005FE0000-0x000000000606E000-memory.dmp

Filesize
568KB

Download
memory/1440-59-0x0000000000DF0000-0x0000000000E24000-memory.dmp

Filesize
208KB

Download
memory/1440-54-0x0000000000EC0000-0x0000000000FE8000-memory.dmp

Filesize
1.2MB

Download