9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6

Analysis

max time kernel
145s
max time network
187s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 00:38

Target

9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe
Size

160KB
MD5

3458f65ed2f72368777dbe1ec5211080
SHA1

b9556a94d02005610782f59ad1c4fd88a683d6af
SHA256

9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6
SHA512

e255fb8759cb7cbfc3f56d605ff9772bd283c15a492cbc7645d8b22a6b6693313e7598d2cb6496ec74639ae5072f8b883bd5646041ee72b99e01d1e92ea693c1
SSDEEP

3072:br8t2TgogzgMA/V1KAt5yN3GP5ZI3kvk4:ezM1x523Ak32L

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\w1r5fwx5.job	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28
PID 2044 wrote to memory of 2024	2044	9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe	28

C:\Users\Admin\AppData\Local\Temp\9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe
"C:\Users\Admin\AppData\Local\Temp\9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe
  C:\Users\Admin\AppData\Local\Temp\9abdfdc409011a8e849e8ec2f0774a2722c136d1e01bbb62d8c660ee3c7642f6.exe
  2⤵
  - Drops file in Windows directory
  PID:2024

memory/2024-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2024-57-0x000000000040A46A-mapping.dmp

Download
memory/2024-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2024-59-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/2024-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2024-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download