c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 23:27

Target

c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe
Size

243KB
MD5

471bc27549710b1c06dbf6fdb4b470f1
SHA1

38662c709640d1bf6a76775b0cc00cba17efb7c4
SHA256

c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6
SHA512

ae427c5d8cd9c3918e42fed16f71f1ca4b15babdd5a10cb1d1419a575f48262bccbc93c75b47ffc50b796586d5206b150abbf0d4d97d4c593a4e86be6130bdc0
SSDEEP

6144:LMUdRXB8mtBeUY6VCbF7VM0CJvA3yxmp1yWHin66tzt:Lhdf8mtRCb3M0CpHG1Lb6t5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27
PID 1360 wrote to memory of 2020	1360	c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe	27

C:\Users\Admin\AppData\Local\Temp\c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe
"C:\Users\Admin\AppData\Local\Temp\c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360
- \??\c:\users\admin\appdata\local\temp\c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe
  "c:\users\admin\appdata\local\temp\c0f59cb38dcb229223470ba223b2388dd8eb42eb31837aa8c729e69aa49181d6.exe"
  2⤵
  PID:2020

memory/2020-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2020-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2020-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2020-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2020-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2020-63-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/2020-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download