8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0

Analysis

max time kernel
62s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:27

Target

8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe
Size

82KB
MD5

4d6081b99e51352fcfe5ef070a436147
SHA1

3bdd41a49a0ef2d37bfdb9f10b6aff2a60a4aa6f
SHA256

8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0
SHA512

88efa49ede081f40942e8c6933b08c270a1adc4479cf4dbcb8b01ff9ddfbbd87ac9ee054f74e33ce76e1239639d708f4024bc5308ec37078bf074348a36f6411
SSDEEP

1536:MnIYUFrJEWEqEbETtlBNg2nCBknvy/4R/R17CQFa3fu8Bvv2:MIYUFrJL3OGBNgZwvyg5P7C9u8Bvu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe
1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1108 wrote to memory of 1964	1108	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	28
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15
PID 1964 wrote to memory of 1220	1964	8949f7150726f222e17d33ec065ab347958f5b53ad42ea6a0d1fdf4a55ffcdc0.exe	15

memory/1220-65-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1964-54-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1964-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1964-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1964-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1964-62-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1964-63-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1964-64-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download