dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428

Analysis

max time kernel
68s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:08

Target

dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
Size

409KB
MD5

3cfff208757cbe2327d3b6453706ca2c
SHA1

6a3d504cac2124ba629d4a9dff7eaaa755c98737
SHA256

dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428
SHA512

1f8643567f121905a26c8ac4b1bdb9fdc1d6b216bcf5412d59c5861d16e94f1fdb11999b057307666966abba2f9202935c56d02af8c084691c7d6eab1213c189
SSDEEP

6144:BlJ9PmJ0aNgn8LEb+XdBP4OhLBxA1s8+wqsnHUf8E53e+SLl62:TjPm2eo/EPlhtGW83tHUF53e+0f

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe
960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 1420 wrote to memory of 960	1420	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	28
PID 960 wrote to memory of 1224	960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	17
PID 960 wrote to memory of 1224	960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	17
PID 960 wrote to memory of 1224	960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	17
PID 960 wrote to memory of 1224	960	dd138a08cc26ea82f69710a4c6616bc3df860fa28d00b04ec7b0b5ef54598428.exe	17

memory/960-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/960-63-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/960-64-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/960-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1224-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download