b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf

Analysis

max time kernel
40s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:28

Target

b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe
Size

124KB
MD5

3575a69e2ca8a76e380b649b5a156293
SHA1

1eef6a7c0d6b6bcf7e6f2e0a8118403249fbfa86
SHA256

b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf
SHA512

78a05107b804457aa0e19130d0f7b5b640075a86b7c97b63b87c3d47c4d2cffdc0602962072a8f615bb5526c81afd0c119ce8d810d0702fba0c4cdd0247f0ba8
SSDEEP

1536:+YlaKWgWSdMlQODZrZ+Ad7eFX1FQJVHR5R8SeTCVMwy+M8q/i/vllv:+Y1RWSWF80OFQJVHR5RFE98q/gllv

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
832	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 1228 wrote to memory of 832	1228	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	28
PID 832 wrote to memory of 1272	832	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	13
PID 832 wrote to memory of 1272	832	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	13
PID 832 wrote to memory of 1272	832	b9a7bb7b3fef8ffe762a9772713a2b0cdba7ef98179416ad47703d17283a46cf.exe	13

memory/832-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/832-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/832-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/832-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1228-54-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1228-55-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1228-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1228-57-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1228-61-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download