5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c

Resubmissions

18-10-2022 00:37

17-10-2022 22:32

max time kernel
242s
max time network
246s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-10-2022 00:37

Target

5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe
Size

345KB
MD5

f1d121ab68b439ac310fb79119ffb044
SHA1

f952140c206d96843baa79f2e0e8454c07fa683a
SHA256

5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c
SHA512

ca0a381a392f9ac1c2954042759955b50e6c1fa735609ac69710658e51c48191f0d99469847b3ebf3f40ce854cb0595387ad986aeacbb5ebd8d05666746e6d6d
SSDEEP

6144:GK5lpVV+1MszHze0x/qgMyy4oh5VyrsyaO6enVX9Pv71L8Er8:Hv1YzeDyy4osa6ljQE

Score

8^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe

description	pid	process	target process
PID 1812 set thread context of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe

description	pid	process	target process
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe
PID 1812 wrote to memory of 896	1812	5f52f4c26c16eceec69e49f93133b4fea3598f840ce5d8065d668dd99f47583c.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
PID:896

memory/896-54-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-55-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-57-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-59-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-60-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-62-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-63-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-64-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-66-0x0000000140003FAC-mapping.dmp

Download
memory/896-65-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-68-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-69-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/896-70-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Filesize
8KB

Download