d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 22:11

Target

d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe
Size

27KB
MD5

051d55a475ecd2d943ba7900229d4030
SHA1

b8c5e9e7bb314e82d240fdd95ebbbb0acf488c2d
SHA256

d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351
SHA512

a9ebfae01cf0e7a8f6b3d51835df52967f0e9be1c8627069fc3b3c2669f1854d19bed72dcdd257dd2ea7aa9b5be4e72aa504d340000099d3dd396d9c1ae94060
SSDEEP

384:zx8QArUxe15Sgd9sgipYFsVDqXyVIkfkT1RvjFVa5RIQybPp18HZ:zx8TAe1r96Vbfk1Va5RIQI3K

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1596	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28
PID 1568 wrote to memory of 1596	1568	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	28

C:\Users\Admin\AppData\Local\Temp\d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe
"C:\Users\Admin\AppData\Local\Temp\d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1596

memory/1568-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1568-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1596-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1596-58-0x000000000040289F-mapping.dmp

Download