2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 18:37

Target

2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe
Size

268KB
MD5

65b62fc01f5a09e2fcf6c4c8d5200e04
SHA1

d8ea51304d958dc34c711086f10e95a1388f6625
SHA256

2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a
SHA512

6aa99f46d3c298ee95a29d6772592e491f92c6aa216b1c5458a8b1c65012df064fce6ef0d1e86f663dce55d0b317da7b34d00ec24ee1226d10d83cb13a7da46b
SSDEEP

6144:rT9DOu9bdtwRoVy6CTpVefty+whfHQmhjrGDqe:v9CURqh9VefI+u/QijY

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28
PID 1404 wrote to memory of 1956	1404	2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe	28

C:\Users\Admin\AppData\Local\Temp\2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe
"C:\Users\Admin\AppData\Local\Temp\2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe
  C:\Users\Admin\AppData\Local\Temp\2226c7f6213001683d8235d7e93ec20166cb42388352299fd7eb2521b926486a.exe
  2⤵
  PID:1956

memory/1956-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-63-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1956-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download