c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 10:43

Target

c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe
Size

26KB
MD5

e33bb8c4b660827907fc45d4e40ebcae
SHA1

77c42ed30fc6195dfe8206256eb883f219391f05
SHA256

c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff
SHA512

d5ad5a387692a6e141e3f1a48214f60ff28e90c285b5deb1f2371e3662bd48ec9cf788605f8dfeced36830b807989f45e1cd817a40ae9fcff23f778e74354de6
SSDEEP

768:l6BlRzQzPsiD1hO7eqMO/cIFOtjGmRpEqlq:s6lg7eFIOjvq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1048 set thread context of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27
PID 1048 wrote to memory of 1928	1048	c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe	27

C:\Users\Admin\AppData\Local\Temp\c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe
"C:\Users\Admin\AppData\Local\Temp\c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe
  "C:\Users\Admin\AppData\Local\Temp\c6fadb638386998c0cfa50b000ba2debcfd2b53482820bb64823daccd8ac48ff.exe"
  2⤵
  PID:1928

memory/1928-54-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download
memory/1928-55-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download
memory/1928-57-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download
memory/1928-59-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download
memory/1928-61-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download
memory/1928-63-0x0000000070001EB2-mapping.dmp

Download
memory/1928-64-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1928-65-0x0000000070000000-0x0000000070005000-memory.dmp

Filesize
20KB

Download