739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:18

Target

739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe
Size

122KB
MD5

8a2077efae68c42976dff312e46a8ef0
SHA1

ab2f85a7be1b9ecb8fd139ac49411e5d3aa0f5f4
SHA256

739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8
SHA512

545aead225312892091dac097fc21dc61a2da51dc406457b0f4ce5cb7ecb07d16fdb7f58c86d203e8e1a90e06ef84a11b1569d6b49cbf000fea05f7fe01e9114
SSDEEP

1536:RwPtLZ7mbtO6ZyEjgn5CRxCccH/5PLAwZVKM+N7US9WXQbk0wohBuIs2u4:RC7mQ6ZHb0NZsMM9WSpwhIs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1352 wrote to memory of 1480	1352	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	28
PID 1480 wrote to memory of 1276	1480	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	17
PID 1480 wrote to memory of 1276	1480	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	17
PID 1480 wrote to memory of 1276	1480	739ad9d987bf13eacf136ecc56b6c5087864ad4b916d3845a5f6a5d83de98ae8.exe	17

memory/1352-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1352-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1352-56-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1352-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1480-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1480-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1480-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1480-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download