b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:39

Target

b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
Size

85KB
MD5

2d0c35a0a40665782bf7b3f8f6bb3c85
SHA1

906078ed29700cbf540053a24e918f5067a9269b
SHA256

b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb
SHA512

718e1d046b5c9350f90fd1ee9a22b21298148bcb1d34d8de84f7ab44aee9c1401e73526f05da272b4058223a85c5076ed7403bd72aafa3d0afbfb197da084d03
SSDEEP

1536:lKahnwDOLFmRNBWMGz4+QfpKJ68gVusuvqWv7QuqW+a:bRwDi0S4luwupvz0uj

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
1948	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27
PID 1444 wrote to memory of 1948	1444	b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe	27

C:\Users\Admin\AppData\Local\Temp\b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
"C:\Users\Admin\AppData\Local\Temp\b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
  C:\Users\Admin\AppData\Local\Temp\b1f31bfb33327bbf48cc89358f4dbb9b4be1becf883dc0307d36c97d9dd7c5bb.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

memory/1948-54-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1948-56-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1948-59-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1948-60-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1948-61-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download