d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e

Analysis

max time kernel
33s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:59

Target

d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe
Size

250KB
MD5

30cf1ca9aed85b2f6f0d8b971b4c8694
SHA1

849b8fe6d7828fb4330d22ab9516b83193f56b6d
SHA256

d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e
SHA512

0ee024cb0d32389447f00cae6c9ff8f3728fe2f44d209d2cf6d667a141b7a5d72c83b1109e84ab08010b762d184b96cb1b62be2abe1b1e603b0c3d115c3552a6
SSDEEP

6144:fssLfRs+UIXv0Ty6gJ/cMGShCIg33EvdBq7:fTtsUXp6gJUMGZElBq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27
PID 1488 wrote to memory of 1260	1488	d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe	27

C:\Users\Admin\AppData\Local\Temp\d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe
"C:\Users\Admin\AppData\Local\Temp\d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- \??\c:\users\admin\appdata\local\temp\d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe
  "c:\users\admin\appdata\local\temp\d16a2fcb206d17d7c3b4bdf3106d5d7a9a4013abf182c093d5a5d143ff6d833e.exe"
  2⤵
  PID:1260

memory/1260-54-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1260-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1260-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1260-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1260-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1260-63-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1260-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download