d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:44

Target

d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
Size

4.1MB
MD5

9439e74301186e03234adb19eb1e525a
SHA1

cf154286505f90df48b31df60478ca1efc2a88d1
SHA256

d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019
SHA512

e9925e735a8c2abec978a3591c7071e5ee7a4ccad986b721deb90843c35a770f9c62c875c1e7017e7da18d157ca54de56a775ee004ccbeb627f080427acf595a
SSDEEP

98304:axky0r4chIPsiSCrQ4S4sXg0RVQhwLpNsPdbyOKgO89A:axkZ7Ib7c9dadHbO4A

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27
PID 1204 wrote to memory of 844	1204	d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe	27

C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
"C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe
  "C:\Users\Admin\AppData\Local\Temp\d61ca614d6cfd37f26ed1596ffa5054e6882b057a525e5d7dd7c41a068ca2019.exe"
  2⤵
  PID:844

memory/844-55-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/844-56-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/844-58-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/844-60-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/844-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-65-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download
memory/1204-66-0x0000000074030000-0x00000000745DB000-memory.dmp

Filesize
5.7MB

Download