a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4

Analysis

max time kernel
34s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 22:23

Target

a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe
Size

107KB
MD5

006c1f147615b4a8cbc5c04916791648
SHA1

aa6af8df001b4d7bcff3550e3988096edd67cee2
SHA256

a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4
SHA512

e785dd76de780770915840506ff9942d267fca4199805219165df75f482aed7cb11df7672daf8874d21c5366e624f27948aae1b3d8c4f5c9ac07772752a8892c
SSDEEP

3072:1z7sD+DpIkT1pAFgtNQ92xlpdnXrxW1OU:1z0+FTT1qwNnlp3cOU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 1360 wrote to memory of 2008	1360	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	27
PID 2008 wrote to memory of 1200	2008	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	20
PID 2008 wrote to memory of 1200	2008	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	20
PID 2008 wrote to memory of 1200	2008	a7c2d37fc2b8cf436165a379ae62eeef3830b77caa95d7e32ccb645b2473c1a4.exe	20

memory/1360-54-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1360-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1360-56-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1360-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2008-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2008-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2008-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2008-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download