b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:14

Target

b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe
Size

469KB
MD5

a271d2c2cdbb3ae3ef1fa148be8dcd7f
SHA1

d3fd42ef7ef78ea988af6a7526e82573ef70f01f
SHA256

b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397
SHA512

de44e0d04b3274d2a2de901b4fa908f4a6ad7d775452441d6db9cbc9c01a31f12f3c4853954b75e7d87ec6a3bd1e0651161a432e2a7c2e353ad44504c5834f56
SSDEEP

6144:7lzX4qv6dpX/2N1KSSbrGEvKR6dbRS9Tk/8vccNPPVn68QHRimsr8lsCWTVEsL5q:J0qidpX/2iW0KsdbEw2BPPBT+Zj0YTr

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe
1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1916 wrote to memory of 1376	1916	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	28
PID 1376 wrote to memory of 1260	1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	15
PID 1376 wrote to memory of 1260	1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	15
PID 1376 wrote to memory of 1260	1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	15
PID 1376 wrote to memory of 1260	1376	b49e05f6f2108fa16eff35b95ce92a0d75e060e09a82aab37e655a9c9506e397.exe	15

memory/1260-66-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1376-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1376-63-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1376-64-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1376-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1376-69-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download