c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 05:52

Target

c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe
Size

271KB
MD5

a2c59f12bc27cecf5e5bebd53ec73142
SHA1

3440d3ebe60458c9345cf1013d8931b539492496
SHA256

c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5
SHA512

9108d1391f9eded5b4787878ae7f64a1ee4184dd5429bd7770d2c185e6b121998528820f4fa8d473a89c9bdb93b04b14861df30031f6a5f0c55f6d77b37071cb
SSDEEP

6144:/YLwViVT2YokFBvrpcHowyJB1jNyvyDvMg7afVofG:ALI42R6BvrpcHOvyvBg7awG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27
PID 1064 wrote to memory of 1036	1064	c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe	27

C:\Users\Admin\AppData\Local\Temp\c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe
"C:\Users\Admin\AppData\Local\Temp\c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064
- \??\c:\users\admin\appdata\local\temp\c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe
  "c:\users\admin\appdata\local\temp\c0cd95427449a9b894c844b6d2d7e7be3f3027b2ed6cf863b6f365e0f72a57e5.exe"
  2⤵
  PID:1036

memory/1036-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1036-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1036-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1036-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1036-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1036-61-0x0000000000429055-mapping.dmp

Download
memory/1036-64-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1036-65-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1064-63-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download