dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 19:09

Target

dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe
Size

52KB
MD5

37ddcedede8fe5a260ad95e0f1637e6f
SHA1

263a2ca94097ae2057c5a390b81426de1ae8c06c
SHA256

dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456
SHA512

596f98016eba26b601b0f17f3db2406754129a8102e84726a24701a439e16f5d9646f3d4d4024fee315e896d4b03b575628755027fdbc90da63a54777640cb2d
SSDEEP

1536:0xYaZ+H3ZsbcP3zAn97yZ9Wpcp9pfbbcS0Gjr:0xYZmbiA2+cJv9r

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe
1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1980 wrote to memory of 1988	1980	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	28
PID 1988 wrote to memory of 1284	1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	15
PID 1988 wrote to memory of 1284	1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	15
PID 1988 wrote to memory of 1284	1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	15
PID 1988 wrote to memory of 1284	1988	dfa282fdf21ede32e22f0eecaecec3fa81a89044a44afaefa7f23dc1f86ac456.exe	15

memory/1284-60-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1980-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1988-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1988-63-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1988-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download