540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 15:55

Target

540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe
Size

169KB
MD5

965809ddf068a7b526cc47a7b2ed40b0
SHA1

412d28ebfa6b185705fb09babe6f7a20fc6fa300
SHA256

540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9
SHA512

ef0bc8fc2a3197043b7cdeba68fd8c15d7364793a6513dca52b54b087125f0516b4227b1b03af7fedba7b7f85b8460488c5136355e1719194e9137c83a026695
SSDEEP

3072:221OyPWu2zkRiiGyCZtoz+n8vlHaKCvpHzmsq6A5zs:221Pr4iGdtUlHazTmsq6G

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27
PID 1788 wrote to memory of 1628	1788	540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe	27

C:\Users\Admin\AppData\Local\Temp\540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe
"C:\Users\Admin\AppData\Local\Temp\540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe
  "C:\Users\Admin\AppData\Local\Temp\540f83aab260b850e95b2682016be568d1f2dcc95afc475a5b996dd0bebf7ce9.exe"
  2⤵
  PID:1628

memory/1628-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1628-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download