b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169

Analysis

max time kernel
8s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 19:06

Target

b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
Size

209KB
MD5

6eb637c09a950bed99fe187ec68a44c9
SHA1

383cbfdbdfb88a62fcb993a9b66dbab4516a66b8
SHA256

b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169
SHA512

d8514ee6e27060ef46d7bb325eb122e9e28bc05cf64637a17319836a5f23328e4e2777a534123167f6dc7af4998153d689f696b8d116d868b2a13caa3c6297e8
SSDEEP

3072:/yAkWQBc70vZLdR5jZCFNtGJwxgH2koSEAhguxc3O7cp9Zn6+U/Lqx9b:/sJBc+Zv5j1Oe9oehPxWrZ6+CI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27
PID 908 wrote to memory of 2044	908	b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe	27

C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
"C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe
  "C:\Users\Admin\AppData\Local\Temp\b5141e499580bf7cdadab5fdce69038ba317e7f6ab9f327d6d99c4c34feb1169.exe"
  2⤵
  PID:2044

memory/908-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2044-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2044-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2044-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2044-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2044-62-0x000000000042C055-mapping.dmp

Download
memory/2044-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download