b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 22:08

Target

b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
Size

312KB
MD5

841028275dccd25dfdec53de87e0998a
SHA1

300e29d5e857dc7d3250ce03e32511efb9f05e33
SHA256

b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a
SHA512

c18000cdb2f571fbee1ebb3c31c1b4f1bd399379a50cd02a1660c3b435d2ae2058250853a9b43bec34fcfab3092189d3c38cda3f43dc24db273362d7845a867d
SSDEEP

6144:LHJStC7lsCyl+UTjmHa7M0Zxb/r2RJOpKIy+FRW62BNS9SXU3f3fnAA8:LgtCRsCy+KaHj0/rtbdoMq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27
PID 1832 wrote to memory of 1168	1832	b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe	27

C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
"C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe
  "C:\Users\Admin\AppData\Local\Temp\b043c7ac366b2b6011832f198264c9f932160d6cee23b1924e3977ae8f3f707a.exe"
  2⤵
  PID:1168

memory/1168-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1168-63-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download