e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:55

Target

e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe
Size

236KB
MD5

78cdbd8f258ca3b938cd23a4b765ec50
SHA1

8f6772942b30205c1c0d2cafe311617af7756f1f
SHA256

e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6
SHA512

86d4e60af09b59f50b35b9ad1334269d0f6092bba50549b491d07381f629b5704a651bc4720ae1cbfbde1f7963a640ed7b93138125c389f568863def3d02df48
SSDEEP

6144:Rp95hZLiOeUg1oMCAvevih/5867863EApVAKOCBuHBNmTSIrgMqibOCC/snIlEOG:TiO4F7TxGAV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1748	1164	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe
1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1288 wrote to memory of 1164	1288	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	28
PID 1164 wrote to memory of 1748	1164	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	29
PID 1164 wrote to memory of 1748	1164	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	29
PID 1164 wrote to memory of 1748	1164	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	29
PID 1164 wrote to memory of 1748	1164	e5da5f80a9b19f84a3f10109dc0e5f612a2f731c04f0e334d5ffea5aca2337a6.exe	29

memory/1164-54-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1164-57-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1164-55-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download