2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444

Analysis

max time kernel
6s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:18

Target

2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe
Size

166KB
MD5

f7f662a1676e1020437f6f34070bd1b7
SHA1

7834cab0841657c167f490cc7ab00f730e03115f
SHA256

2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444
SHA512

7408d4fdca7061c930cf5ee5edbb6f782bb2992b73c6afd07d1dd5bc7949fe95628cd08392d30e00d6acd0ce7012f88c10bc013cc75519dccaecb54366f87bcd
SSDEEP

3072:016EZna/m+djZr5f7SnMmVzbOBx8OcqXQo5KzOdbt8YxM9kP8sz1p:OkuYN5DSnM0zbm5Qo5KzOdR8YPxp

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28
PID 1640 wrote to memory of 1724	1640	2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe	28

C:\Users\Admin\AppData\Local\Temp\2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe
"C:\Users\Admin\AppData\Local\Temp\2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe
  "C:\Users\Admin\AppData\Local\Temp\2f852f32b854d0f844f6592c9a37aa23dc438b7c03c28bf422d537f61b034444.exe"
  2⤵
  PID:1724

memory/1640-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1640-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1724-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-65-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1724-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download