5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:08

Target

5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe
Size

320KB
MD5

05904d26bcfada5a5698a4539a5d382c
SHA1

87b4780b7b5cf3127d3674735ad2907ea8756f78
SHA256

5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b
SHA512

6e07ea432afa4102243e7d89ef48c0934a479e68562db186ac54a906d3ec3f7aa54e0353e752febed518a87e1fb24fcacaa26aadb07b3f0252dfbdd68a0ac526
SSDEEP

6144:sCd6LD4GcnK4lONMzCfkUX3ZzsTZHkVX53bIlRlYHLGhDAKh7jWa:sJmKe1YZwZEVX5MUmjWa

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27
PID 1672 wrote to memory of 1644	1672	5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe	27

C:\Users\Admin\AppData\Local\Temp\5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe
"C:\Users\Admin\AppData\Local\Temp\5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe
  "C:\Users\Admin\AppData\Local\Temp\5040047102e1a7636f072fd39c851a5e296989d9537bc802fd611de3aa05c87b.exe"
  2⤵
  PID:1644

memory/1644-54-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1644-66-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1644-67-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1672-60-0x0000000000460000-0x00000000004B4000-memory.dmp

Filesize
336KB

Download
memory/1672-57-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1672-64-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download