aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 20:55

Target

aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe
Size

267KB
MD5

982828f5d07edf120bade0a2be80f9af
SHA1

d2e1cb8c728098fdc7248dc5e3d73a2d60e3bd3c
SHA256

aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d
SHA512

39769bceace96351cea36ca59b4c61f590c1981b2c02624f8d9efce4976e685b32598c5de790b4db1c6d140ce3d1500d755144432090403b7fa4faf38b0e46ed
SSDEEP

6144:7IGlfLO4cqwTzzcjS4xLBzfTZgrqfe8S/CKh:7XfC4cvHcGyVzfNqqI/Cq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26
PID 1388 wrote to memory of 1536	1388	aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe	26

C:\Users\Admin\AppData\Local\Temp\aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe
"C:\Users\Admin\AppData\Local\Temp\aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe
  C:\Users\Admin\AppData\Local\Temp\aa4b31bdf637b55560e11352fbc52fd15521438c4c92c395a4c2bec3e69d535d.exe
  2⤵
  PID:1536

memory/1536-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1536-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1536-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1536-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1536-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1536-63-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1536-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download