b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:13

Target

b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe
Size

481KB
MD5

dee8c2e138f7776530cf2905d700acdd
SHA1

b47479eef60bee4f931514ca1c367af1ad78ea2a
SHA256

b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305
SHA512

78211d08c4bd5007afaa0ee4308c8725bb806778668be343f270a79ef5c94363e9558ff8659d3bfa1e7f39152e8b0d11b64223bb54a363e85bdc9836cdfc0887
SSDEEP

12288:ZM3srk4xBN28vqcDbGrTiCyTx2qXoND+A:m8rjxBc8hOzKGSA

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28
PID 1488 wrote to memory of 1744	1488	b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe	28

C:\Users\Admin\AppData\Local\Temp\b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe
"C:\Users\Admin\AppData\Local\Temp\b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe
  "C:\Users\Admin\AppData\Local\Temp\b7a65f7ccb3a87caa3d6950ca8cec278b887eb77cf550652aff7c0ef2f22f305.exe"
  2⤵
  PID:1744

memory/1488-54-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1488-64-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1744-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-58-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-59-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-65-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1744-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download