595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 12:56

Target

595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe
Size

60KB
MD5

0603c768820499e8732fdeeb8f33cd59
SHA1

14b64d747c732f87cc5880cf45d0a547d2b36016
SHA256

595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58
SHA512

89abb73921ab45ce40a6e6e0fb47ec68b06f8adcb969ad0ab61117da7890e8cea79e220fe79d6c78a3a538495de1ffaf77be16e54a0b207ae82140adbf9cb73f
SSDEEP

1536:hIE2Fg7XNe8asFeqgMfiBG2kjsGeua2biZt:n2Fg7paaiQdeua2E

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe
824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 1380 wrote to memory of 824	1380	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	27
PID 824 wrote to memory of 1212	824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	13
PID 824 wrote to memory of 1212	824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	13
PID 824 wrote to memory of 1212	824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	13
PID 824 wrote to memory of 1212	824	595aa1b67b6f56c99f328144f58bebc5eab6f1d5f9cfb7476148c80c044a2f58.exe	13

memory/824-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/824-63-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/824-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1212-60-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download