2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 13:00

Target

2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe
Size

204KB
MD5

e1551ae30787dc1917a3931c0a78eead
SHA1

7fa225695fb6a7cf8ed1fe9b6273dc6d2d4e49d6
SHA256

2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99
SHA512

5cf6dd99953ff002cb40f2a3216c23ebb4bd7bdc2b6128c361dc3efaa1e5950bbebfcd7a5a653cfb3698f1df6034ea46c80d6e0c4d7b6d480f92a31d16ee49d2
SSDEEP

6144:dfH74N0nUFxFFWYxofKx/8GcsMBvMCmJpw:pb5ngLFE+esTCmE

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81
PID 4816 wrote to memory of 1772	4816	2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe	81

C:\Users\Admin\AppData\Local\Temp\2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe
"C:\Users\Admin\AppData\Local\Temp\2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe
  C:\Users\Admin\AppData\Local\Temp\2b7d7ce067b9bd88ec725a5be9f1c0773071066df06a878a3a7b7af341e61c99.exe
  2⤵
  PID:1772

memory/1772-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1772-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1772-137-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1772-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4816-132-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4816-133-0x0000000000920000-0x0000000000962000-memory.dmp

Filesize
264KB

Download
memory/4816-139-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download