c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:30

Target

c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe
Size

25KB
MD5

e9913db8566bffcb98c68e31aedd7424
SHA1

80bb6a75a8e6dfdc151c47557b2af310a040d150
SHA256

c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1
SHA512

561e301f7691f941183bb7da933403ca79b8b2ff58972d0515bbbfb14559e9c81df5e5b70b8c30da8206e2cbc1def8d1a6ed177e01ee53ab37c84bc005d1d158
SSDEEP

384:kGH1dQIozPzq7Di7tnaiDk2NP+Vwc5d2NdNV1qa+KFD8kgQCN2FRU4c1HdOS+8KG:/0hzqDKAiDNtAd2TnYIY/QLg9HTDEet

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 940 set thread context of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28
PID 940 wrote to memory of 2036	940	c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe	28

C:\Users\Admin\AppData\Local\Temp\c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe
"C:\Users\Admin\AppData\Local\Temp\c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Local\Temp\c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe
  "C:\Users\Admin\AppData\Local\Temp\c48df2fb1e00c4f743e93a506d24dd4005a0c2d2e56e187863d7fb568ab86bb1.exe"
  2⤵
  PID:2036

memory/940-54-0x0000000001000000-0x000000000100C600-memory.dmp

Filesize
49KB

Download
memory/940-65-0x0000000001000000-0x000000000100C600-memory.dmp

Filesize
49KB

Download
memory/2036-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2036-56-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2036-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2036-60-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2036-62-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download