de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2

Analysis

max time kernel
120s
max time network
109s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:11

Target

de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe
Size

119KB
MD5

66e1da4310448594a674ef7faf30950c
SHA1

d19e76c008031cc24246b50572d2637cf3c1458b
SHA256

de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2
SHA512

ece4d47fa7356c622747aedef61694ebf0918c4e7b4d0ba3d18965665b9249fdb1bea102daa8ac01d18e549f21e65fbdc59b02c1f22ada98c0ae5a1201b676d4
SSDEEP

1536:9aLV5W/CU4r72xKjRVgMeLccK9REiOO98/ksQUPXOHZA4mBRKk8+Q+URs8d2:9aLPjYKjRrVcws/ksvcWBRKk3QL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\orqoq.job	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28
PID 1628 wrote to memory of 1988	1628	de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe	28

C:\Users\Admin\AppData\Local\Temp\de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe
"C:\Users\Admin\AppData\Local\Temp\de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe
  C:\Users\Admin\AppData\Local\Temp\de3405793fab2df26cd09bdbc22c0af48233eb391bfae4c32bc1408e5d3ba9c2.exe
  2⤵
  - Drops file in Windows directory
  PID:1988

memory/1988-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-59-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1988-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1988-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download