f29204864222579ae1524265d697bbb19c910b95ffbc692f43f3420e92cfa4ee

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 07:21

Target
startix.exe
Size 3.3MB
Sample221010-h6pc3sbab3
SHA256 f29204864222579ae1524265d697bbb19c910b95ffbc692f43f3420e92cfa4ee
MD5 73d0bd27f57c2ae7bca3cd1deb4d7960
SHA1 e9754cab3bf67db5920bdd53225c07ee8791ab57
SHA512 f3ae00c3ec9d3112f358d70450c5d97c0c6dbf6821d2646dca3a212a2940823157de70ef971ef5af2e4b90d4ef5a21eb3b03e5937bea1b761fa85833c88afdc8
SSDEEP 49152:tWyC5V+pGLKhLKk1KDQJKfHl17wLMPjwEl3/:tfCu8eB9Kt6LMPj/
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 146988	1444	startix.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28
PID 1444 wrote to memory of 146988	1444	startix.exe	28

C:\Users\Admin\AppData\Local\Temp\startix.exe
"C:\Users\Admin\AppData\Local\Temp\startix.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:146988

memory/146988-54-0x00000000001B0000-0x00000000002B2000-memory.dmp

Download

memory/146988-56-0x00000000001B0000-0x00000000002B2000-memory.dmp

Download

memory/146988-63-0x00000000001B0000-0x00000000002B2000-memory.dmp

Download

memory/146988-64-0x0000000075D71000-0x0000000075D73000-memory.dmp

Download

memory/146988-65-0x00000000001B0000-0x00000000002B2000-memory.dmp

Download