046cd8b525c82f4db3b39d9a3f1b4f7dbad48dee24af3739c81e219ab56640db

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/09/2022, 15:12

Target

file.exe
Size

509KB
MD5

c25b44fac10fef4f7a400548810f4335
SHA1

b86cf34c56a92b14acb59c4280e144b64a9d4c7e
SHA256

046cd8b525c82f4db3b39d9a3f1b4f7dbad48dee24af3739c81e219ab56640db
SHA512

109943351bc489ca9ef267f5fe2e0e108ea864414b47f4097bc512a0e8d86f7bb1cd60b89d6876f0fceb2488113c12cc2f6d2abb2930d9f3010fca2e53529dd2
SSDEEP

12288:o9WaQa6g2K0Gds+ALpMAm/tSeG5+ry4WBGh+sI:C3Qa6g2K0GKpc/45+rgGVI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 98812	1960	file.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29
PID 1960 wrote to memory of 98812	1960	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:98812

memory/98812-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/98812-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/98812-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/98812-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/98812-64-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/98812-65-0x0000000000AF0000-0x0000000000B4C000-memory.dmp

Filesize
368KB

Download
memory/98812-66-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download