78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 07:26

Target

78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
Size

285KB
MD5

dfce3d57c83c019f263d3e8f3c6b8f39
SHA1

41d6e29f16b3ad5c6a4afd54633b55dc844d72e2
SHA256

78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc
SHA512

3fd97d32601f68f2f482fe265d27b1a12a1d4b6279e21bb47e0cc4b0d826387e6dc5e8e44add838549405e2e0acdbb8af05d0da74dd4a1fcbc731ec738cb564d
SSDEEP

6144:EX6BDomz60SRPgwPiEe3JtKeju6dM00MmxoMul8jX:5D9z60gPs3JXTddmP2c

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1248 set thread context of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26
PID 1248 wrote to memory of 1384	1248	78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe	26

C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
"C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
  C:\Users\Admin\AppData\Local\Temp\78d5419674bbe5f773698193a6686af7115bf21f3a3ef4d509a2e4479527fbcc.exe
  2⤵
  PID:1384

memory/1384-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1384-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1384-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1384-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1384-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1384-63-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1384-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download