9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:35

Target

9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe
Size

53KB
MD5

ef05d46ce22d3e9e927f4621525b7a02
SHA1

8226e4810a6ed58920ad36e4ff8d72d6f78a6ad2
SHA256

9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb
SHA512

6d76f4a19ba158488a86003a9cac4fcb2076bb1acd660e65efc1a1b8a8cdbe3827a958bc955ffab027ca2c05e5319489011269672e66f5dc0d7142f4fbf05fd0
SSDEEP

768:3X3y2+HBend2QLgsrAhL6oQ5DHnugSAIoxmzdAsdUH5x53RrMXe+GdYU:H3ybAghyBnVIoxmzdAi0hqe+Gv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28
PID 892 wrote to memory of 1824	892	9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe	28

C:\Users\Admin\AppData\Local\Temp\9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe
"C:\Users\Admin\AppData\Local\Temp\9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe
  C:\Users\Admin\AppData\Local\Temp\9402fd60a501228071e1f2731edc447ee8e9af3c3595b72687b137967ce7bfdb.exe
  2⤵
  PID:1824

memory/1824-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-64-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1824-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1824-66-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download