cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:35

Target

cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe
Size

51KB
MD5

13019a126ff0a84deadf1c351d83b4e0
SHA1

438af54d1e80fbb452c5c747785361725a2df000
SHA256

cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66
SHA512

1e084b42b477431b2db74800c0dbc72618a9b1e72ef72da00c6f09b612beef94906568a6c911081796f94e1f95b16b8d805c7d0800672ee88abdbc7d89a1955d
SSDEEP

1536:YjqzQSoffbTlhtAMwG8DNERFYPrlFV4xF:jsfffXZ8D+RErlj4H

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1268	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28
PID 1096 wrote to memory of 1268	1096	cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe	28

C:\Users\Admin\AppData\Local\Temp\cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe
"C:\Users\Admin\AppData\Local\Temp\cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe
  "C:\Users\Admin\AppData\Local\Temp\cf19ea8215e98467bcccb05e7d4e1133b030b8d3204feb288bf9a41c7723ca66.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1268

memory/1096-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1268-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1268-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1268-58-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download