12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 00:45

Target

12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe
Size

821KB
MD5

d6bb35b442df2f188e199726971ecc5f
SHA1

93ef3f075e4980d8d2573248126c520839f12014
SHA256

12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e
SHA512

58c0181fba408074382bbec217d06e7344dd8064ebb2c321a74e9e46f53e153069a3a1f7ccb2f541b7dbb02a96224eb685c3c712ccf59b1aba250c765188c5b0
SSDEEP

12288:yQEs9OamFaOt3apooPHxESJ8jzb1thUaqCOiQgTtQQkXfzVQo3hsPjtJ4b:gnfFaOt3aphHx2vbLSaFy5VQo3u7to

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 972	1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe
1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 972	1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe	27
PID 1368 wrote to memory of 972	1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe	27
PID 1368 wrote to memory of 972	1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe	27
PID 1368 wrote to memory of 972	1368	12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe	27

C:\Users\Admin\AppData\Local\Temp\12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe
"C:\Users\Admin\AppData\Local\Temp\12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe
  "C:\Users\Admin\AppData\Local\Temp\12a01c39c2f36da3ea691203721164e713fa5be537456a9975283de086fadd2e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/972-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1368-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x00000000003E0000-0x00000000003E4000-memory.dmp

Filesize
16KB

Download