2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:50

Target

2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe
Size

300KB
MD5

c44bfa414a5cb3f3f4d266f1291f0ed0
SHA1

bdaafce79a8fdeee7300b4f0c2001f6c66d6f47e
SHA256

2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a
SHA512

cf8f4a915b3cb7248326f5ce56791ad1723452c716cf38ab5a10c1b52cc04b952fbe91deb7725dd56318e5938dfa17bbb04fee9d8bf1aa0d1fde5043dd5e0963
SSDEEP

6144:Ky+IeCZc08uF3KGCMwrtm9JYcsIhVr2KEo0gwSqgcWacUvQYjxHLg+lIfJ1yu:F+XCVx/j5xr2K4geFnlY9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27
PID 1724 wrote to memory of 1048	1724	2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe	27

C:\Users\Admin\AppData\Local\Temp\2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe
"C:\Users\Admin\AppData\Local\Temp\2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe
  "C:\Users\Admin\AppData\Local\Temp\2ca27613a9c3eeb7ca613ab133f4598e41e9b05648e1151e40416ed24bd6db5a.exe"
  2⤵
  PID:1048

memory/1048-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-65-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1048-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-67-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1048-68-0x0000000001230000-0x000000000127F000-memory.dmp

Filesize
316KB

Download
memory/1724-54-0x0000000001230000-0x000000000127F000-memory.dmp

Filesize
316KB

Download
memory/1724-64-0x0000000001230000-0x000000000127F000-memory.dmp

Filesize
316KB

Download