8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 02:03

Target

8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe
Size

107KB
MD5

1194915a2525360fef60ebe3e69efde5
SHA1

99a47c3d112ee91354df762e43e76ade21d3da86
SHA256

8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861
SHA512

5eb6e7a04a748a462d4c3a8fae6e7c4d52b19f36ef575a0183b5a5bf44f8ea6bfd284202c0f403ceaed25a8900767c741d7a9147331e143a3d3344dbb0b5412b
SSDEEP

3072:A7fKi4j+eYwSYYYYYYYGK+Bvvyf6BzPZTByuAw5jKE/:A7fKip8AKAiiP9Kw5j

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
964	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 1960 wrote to memory of 964	1960	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	28
PID 964 wrote to memory of 1268	964	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	16
PID 964 wrote to memory of 1268	964	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	16
PID 964 wrote to memory of 1268	964	8794e15023ae9340eef63f50d320228e13a3f94a4f62ae7ab975bffeb8660861.exe	16

memory/964-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/964-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/964-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/964-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1960-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1960-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1960-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1960-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download