46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:45

Target

46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe
Size

172KB
MD5

3e4c4032033b7d8c505dd6b1ad883fe4
SHA1

a43c589cd70f1ad9f4bf482522b1e27d47a330fe
SHA256

46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158
SHA512

5ccf9e9e1bf7c165faa57862ea1cf10aa1aae56073fb555aa900bec78d89a21b590cfb9b2a5b9128d04ccf0c24866bcd4894c8bece258776e44ddaa0b0b4e608
SSDEEP

3072:rPmAIdMDQA5eC8bcMXNwTr2jP4rPF+7JfA/QmosuiNyHwWJrT4haxnvEy2rN:6AId8QALW6Tr3YFAIm8iNMYoxvEFR

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 108 set thread context of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27
PID 108 wrote to memory of 1940	108	46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe	27

C:\Users\Admin\AppData\Local\Temp\46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe
"C:\Users\Admin\AppData\Local\Temp\46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe
  "C:\Users\Admin\AppData\Local\Temp\46ea2a06c7a525e0d96fa6c1e9b9d9255addd0589b582a65225680e7bebaf158.exe"
  2⤵
  PID:1940

memory/108-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1940-59-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download