b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 07:40

Target

b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
Size

262KB
MD5

0a8eca7c20b825fd754879c64009817e
SHA1

a25f775838797d5c90cf7cbb5895d2457d2fb067
SHA256

b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f
SHA512

a7f8d60cf011a33bd5233029777dcc9fec528b5df97acff48aabe8a7148277b0abf25efaa12f841717953fc1ea00c87a28c430cfd2160d7015019863141fc07f
SSDEEP

6144:c1azDD9YMjfxZWT2oSEe9laHxmN001lda:cSH9KzFe9cRmNf/A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1416 set thread context of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26
PID 1416 wrote to memory of 1920	1416	b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe	26

C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
"C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe
  "C:\Users\Admin\AppData\Local\Temp\b5df05bccc2b1a7207047bc0cbbba2c1a2ab538558ff58d87587bae0e008ce4f.exe"
  2⤵
  PID:1920

memory/1416-54-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1416-64-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1920-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1920-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1920-58-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1920-59-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1920-61-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1920-65-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1920-66-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download