9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 11:29

Target

9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
Size

169KB
MD5

0a578b57112b45cc0233c8e3278f752d
SHA1

a9098db5a56714f72eac8d34142d9044aab372e2
SHA256

9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca
SHA512

3def4b38735ba5418f00e1c8f043a586d7e585d6eef6b54489c977ee1ec32b0a998f3e6c3dbf5b875d5a82980d5c47d15ebcad4b2e1e0c564de5379acb6d1f3a
SSDEEP

3072:iKXR/zNqhJpCGXwxK3wgZci6BbJVyjZdyHdJWheQGyT6pVTIOk/qTELtVN1UJnry:iKBRsJpP3XZci6B9VeZdyHCeQGHpyOoZ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27
PID 1280 wrote to memory of 1036	1280	9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe	27

C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
"C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
  C:\Users\Admin\AppData\Local\Temp\9bed56c3569b6b095757f6808abf54fd411bffd52a0156b181118c197bcd99ca.exe
  2⤵
  PID:1036

memory/1036-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-61-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1036-62-0x0000000000431055-mapping.dmp

Download
memory/1036-65-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download