5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18

Analysis

max time kernel
31s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 04:35

Target

5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe
Size

320KB
MD5

042cbabba711ea97852cb03595aec809
SHA1

40aa561976a21d0ed3dd4c21a19e8c523ba000c2
SHA256

5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18
SHA512

f9ac9bd4e25d9d5fd1590b459d5539d4b300010aefd03efb746fc68d73b4fcd79454d433f1e4f211e66a6fda4894249157e4991103e3be6d05dd25fe1f68aca1
SSDEEP

6144:13aGNytJZOLW2oalWiocvm3VSXwCAHu6uZUGW7u2N+IYaED9OfGLj9vN:V2tJN2oaEioImIwZUU3X+IYtOeLj9vN

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28
PID 1584 wrote to memory of 1864	1584	5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe	28

C:\Users\Admin\AppData\Local\Temp\5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe
"C:\Users\Admin\AppData\Local\Temp\5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe
  "C:\Users\Admin\AppData\Local\Temp\5f1fc1aedd4c8c2e47af9908559eeb63402d281a6629a9d3f551563ff2faaf18.exe"
  2⤵
  PID:1864

memory/1584-54-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1584-65-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1864-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1864-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1864-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1864-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1864-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1864-62-0x000000000041758F-mapping.dmp

Download
memory/1864-64-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1864-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download