d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d

Analysis

max time kernel
128s
max time network
142s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 21:55

Target

d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe
Size

124KB
MD5

57c0afb44aab38d38970c9a9060b9585
SHA1

eee9e25b7272afcbbfed552ec4c35011a743a96b
SHA256

d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d
SHA512

7f01b1844da96b22f914302f25f76444cac1247d008e8a921adc62c7faad1acb211896b1bde5f184eb2e1494dea4369f1e1857b43e1f655f0ddfb702b2a260ae
SSDEEP

1536:QQplaAq42yknwltihV51704/Z/YsXmvxy0V76tZiqvl85CphbMh5hKY0SlX5E:QQ/qlUtitW4pYsXEw0V7MiYl85Z5heO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ahi9eb74b.job	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27
PID 1768 wrote to memory of 988	1768	d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe	27

C:\Users\Admin\AppData\Local\Temp\d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe
"C:\Users\Admin\AppData\Local\Temp\d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe
  C:\Users\Admin\AppData\Local\Temp\d57ff2cff9b633e1cf8eda768a36df2c18a28466372c7d5ecea9eb6c41c95d9d.exe
  2⤵
  - Drops file in Windows directory
  PID:988

memory/988-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/988-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/988-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/988-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/988-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1768-60-0x0000000000420000-0x0000000000515000-memory.dmp

Filesize
980KB

Download