cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603

Analysis

max time kernel
167s
max time network
264s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 04:43

Target

cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe
Size

154KB
MD5

4f9496fcc01004b8f12b54e3637d86d1
SHA1

68d090731ff4e11a59ef522a9f0c444a81afbf9e
SHA256

cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603
SHA512

696222c20eade9ebc05fee92f867ad35f760a8ee041d33a16e4cd2ffa47c92948c160c287531e6dc43f75673b256c20454a4f9bbdf8dc5465b4b7b02d02a8663
SSDEEP

1536:V7QjESbfsnMguxqEZNnd5RxrnBqm0GYDnJOZBghq/mJimy8Omx1V+tSZZBq:VzSlgucEZNdDvV0DJOZBb/gV7QUZZBq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\jtcu.job	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28
PID 1680 wrote to memory of 1460	1680	cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe	28

C:\Users\Admin\AppData\Local\Temp\cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe
"C:\Users\Admin\AppData\Local\Temp\cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe
  C:\Users\Admin\AppData\Local\Temp\cce57eb83480454d84494c58e5c99738a49dd4c7c192c7419243bc6880934603.exe
  2⤵
  - Drops file in Windows directory
  PID:1460

memory/1460-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1460-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1460-59-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1460-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1460-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1460-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download