4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:40

Target

4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe
Size

68KB
MD5

fbf7e4c4537cb3979c87972a851ee4d3
SHA1

3124690749b240120ac11d8b1e1857194df9c2b4
SHA256

4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628
SHA512

72c44384dda4bd4d902584550e2b67cd63bb9c118b721722ed140d053c8d3910862ea493599d53be4f6fe3ccf9c758b6bb5d09fb61a410b38782081f029915e9
SSDEEP

1536:KzbzEaehTMBLIeBa3n5ReL8biW8AL+7GQkp1g:KzPohYBLIz5eWbL4I1g

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1188	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1188	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe
1188	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27
PID 1532 wrote to memory of 1188	1532	4a44585d679a40b9f69621610c0250af045d75f0f42ed2d7c4cc5d4ea82b6628.exe	27

memory/1188-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-66-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1188-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1412-68-0x0000000076ED0000-0x0000000077079000-memory.dmp

Filesize
1.7MB

Download
memory/1532-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download