a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b

Analysis

max time kernel
58s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 16:18

Target

a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe
Size

298KB
MD5

800671c66f1c52f72d5bf9bdeb99e470
SHA1

c31ff8cd00665d5a673f2137289308544062cdee
SHA256

a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b
SHA512

9d16875f084a8973aaaf67ed6d05ea5b9b05ce9cd21432895e7351e03f48a75b3fb25fe1d6d9a37643429ae30eb31ed713c7e5754ddd3450ee3d2a746ab9a5ae
SSDEEP

6144:SYKSbwlGB2KX3wWLLLV95Dmc81XBxYotxaTWpnBZnnRCXONllx0z0:gUwlGBJwsJmB1XBGGxaS5HRC+NllF

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28
PID 308 wrote to memory of 856	308	a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe	28

C:\Users\Admin\AppData\Local\Temp\a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe
"C:\Users\Admin\AppData\Local\Temp\a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe
  "C:\Users\Admin\AppData\Local\Temp\a12e9b15b40f982f57ee567869b4341d343a6013c5f68e8d80b8415505094b6b.exe"
  2⤵
  PID:856

memory/856-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/856-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/856-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/856-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/856-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/856-63-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/856-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download