a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e

Analysis

max time kernel
148s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:07

Target

a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
Size

122KB
MD5

606305f232f9861627be9552fde5bf13
SHA1

18d41f9dde4dcaf5d7c73683a0c604940d8ec086
SHA256

a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e
SHA512

f11500755f6941b5c7a710f7e63665b2fddd618da9b46df98bc25932a047c669d8832ac9070683bc3daa34dd0bb21ef8d0c328da343ced208713cbc6ef11c5fd
SSDEEP

3072:aERSHvAEiCSWgYGeTVaMqFr91a+tchcSbpAYp08c:aERGAbb7YGvr9ZMAYuP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

description	pid	process	target process
PID 4588 set thread context of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

pid	process
4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

description	pid	process	target process
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
PID 4588 wrote to memory of 1852	4588	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe	a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe

C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe
"C:\Users\Admin\AppData\Local\Temp\a7ee547a9aee2599b10f6e44f0015a6b18751666dbfb280d924cd9ab14a6a54e.exe"
2⤵
PID:1852

memory/1852-133-0x0000000000000000-mapping.dmp

Download
memory/1852-134-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4588-132-0x0000000002160000-0x0000000002165000-memory.dmp

Filesize
20KB

Download