ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:14

Target

ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
Size

333KB
MD5

47317c35b065f6b2a483fc0115aff9cc
SHA1

aed6337b6048f1ae37d5922b24e98ed91e8f9cb8
SHA256

ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c
SHA512

f3ff79bdf29086a60eab22c0b1a1537b84033afc9c55587caf6e088c34694288272386cd624885be1cce446d04048dff33da0230c7319b17892604a01d80fcdc
SSDEEP

6144:Ff88r7YXAL5PCv5zVr8KyTX5kCY00X4XkQK35GA2z:Ff88oXyav9yKHA6QAs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 872 set thread context of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27
PID 872 wrote to memory of 1492	872	ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe	27

C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
"C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:872
- C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe
  "C:\Users\Admin\AppData\Local\Temp\ac48c1ac46d8307f5aca9cecf339d71da2be767238ad9b60680bb46a4c0a690c.exe"
  2⤵
  PID:1492

memory/872-54-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/872-64-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1492-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1492-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1492-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1492-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1492-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1492-65-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1492-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download