50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 22:42

Target

50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe
Size

187KB
MD5

58a8ef19c75fd7a8e04f65b37c0b2d26
SHA1

92994068e98eb96c54cb0a615551c2c8fa388374
SHA256

50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f
SHA512

98c466d7cfee4dba1387203b03d76641f53fe3b964c980013d5af86ae6a2cc9742b623e14e82cc1c8e9a4b2df990e7cd48f2674ce69ff41b584a734f5d2c762a
SSDEEP

3072:9p5xIdyyYFm40VXE05Gp1S7AuuTEi6NyspFbey3lKnZpa9:z5xTyUKXE5qYTEiKp/3wzk

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27
PID 900 wrote to memory of 960	900	50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe	27

C:\Users\Admin\AppData\Local\Temp\50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe
"C:\Users\Admin\AppData\Local\Temp\50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe
  "C:\Users\Admin\AppData\Local\Temp\50aa83a7306e823d2c267a9f84595eb918dbc9b6fbbefa55b3d15f32fb1d7b5f.exe"
  2⤵
  PID:960

memory/900-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-62-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/960-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/960-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/960-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/960-60-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/960-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download