c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac

Analysis

max time kernel
86s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:58

Target

c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe
Size

122KB
MD5

4933baed348fe2ca66d29f629672efc2
SHA1

f36dd81685a554461ce16a446226c78c8024c411
SHA256

c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac
SHA512

1f0894ed1bedce296176d50e7190442f5054a16fda02dc469567570ee971edc4e4e98d49ba6e6013d0f6350b71d4228b1fed5223953792ae3ab06a6b589c82f8
SSDEEP

3072:MDetAVbU3JoJg+Q1e2kpKKZi5e8oie9clHkj+9dclEFV4GOK:MDetL6Jg+j9j59KKzKFVnt

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe
928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 1164 wrote to memory of 928	1164	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	28
PID 928 wrote to memory of 1212	928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	18
PID 928 wrote to memory of 1212	928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	18
PID 928 wrote to memory of 1212	928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	18
PID 928 wrote to memory of 1212	928	c9a477929daa96754bd5affea43e2358aa56885d5ca1a546c08b68c562289aac.exe	18

memory/928-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/928-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/928-60-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/928-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1164-54-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/1212-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download