74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:46

Target

74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe
Size

227KB
MD5

93de71c37daa7368477b5f489e9b9900
SHA1

98730779d0cc15b5128735f28c7b98e3a930ef68
SHA256

74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941
SHA512

55fdde097edf7acb5da58c20d269feb1937d230f96ee1bcbbfc02369c2e902cbd750e4aca6ba7da6fbfc608d52668c5d696028826f7358a633211793beaec2a3
SSDEEP

6144:x5ob8Hr+juFoaPznY+Rcr8HPdcM60yWC+56kljMEv5:rob8HSUr5yPp66kljl5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28
PID 1932 wrote to memory of 668	1932	74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe	28

C:\Users\Admin\AppData\Local\Temp\74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe
"C:\Users\Admin\AppData\Local\Temp\74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe
  "C:\Users\Admin\AppData\Local\Temp\74dbdcb4933acc5bc5c8993baf2732312fd9066dce2af4f0e03256f115c68941.exe"
  2⤵
  PID:668

memory/668-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-65-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download