d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e

Analysis

max time kernel
179s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/09/2022, 10:20

Target

d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe
Size

3.2MB
MD5

b2ca4d4ff09e9e1798bf77463498252b
SHA1

002f0391509ee466bd3703848f0fc5946bc2a9e1
SHA256

d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e
SHA512

76712d9f185b0b70e816c87a54dbe012380e74280506882f4f0fbe52b7c674fc4b0dd136f01cb2f99dbe1cb5f98635baefee7f2ded339b3e853cf5f410820ac2
SSDEEP

49152:tplUkBN4wZB13+ckJtzZBbihy7OJvcjFl3I:vlUkBN4wZBJ+ckJhfOJvcjc

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27
PID 1184 wrote to memory of 99148	1184	d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe	27

C:\Users\Admin\AppData\Local\Temp\d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe
"C:\Users\Admin\AppData\Local\Temp\d2dfb38dd424687323a859c99446aea75122e82685ae35627185c0d4bb79a40e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:99148

memory/99148-56-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/99148-54-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/99148-63-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/99148-64-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/99148-65-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download