ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a

Analysis

max time kernel
249s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:04

Target

ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe
Size

214KB
MD5

afbda4b02104c0c71c362e079f89c33b
SHA1

158cfd7600ba79c06688712bc60d74971400a4ca
SHA256

ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a
SHA512

abdef2ebebde8a281952b6fb040ca2c2040adf461acb53a4d0d90aee682e027d208d84b4e68c13818217bceea38cb586e119ced0903fb293ced23ed381cc006a
SSDEEP

3072:STtWiHdTYBitXNI/+bZK2FvFK5N2z0BgVTeh8n9f87P7Q2:+tW0TYBIXNIyO2z08Ch8p87Dx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe

description pid process target process

PID 772 set thread context of 564 772 ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe runas.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exerunas.exe

pid process

772 ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe
564 runas.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

runas.exe

pid process

564 runas.exe

description	pid	process	target process
PID 772 set thread context of 564	772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe	runas.exe

pid	process
772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe
564	runas.exe

pid	process
564	runas.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe

description	pid	process	target process
PID 772 wrote to memory of 564	772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe	runas.exe
PID 772 wrote to memory of 564	772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe	runas.exe
PID 772 wrote to memory of 564	772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe	runas.exe
PID 772 wrote to memory of 564	772	ce422a2f575a7ce0fcaad2996ced34162cbb946542a67f36b03e2457da084c6a.exe	runas.exe

memory/564-56-0x000000000008CA90-mapping.dmp

Download
memory/564-58-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/772-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/772-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1312-59-0x0000000001CD0000-0x0000000001CDE000-memory.dmp

Filesize
56KB

Download