6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:45

Target

6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
Size

80KB
MD5

5c84a441fed69b37bcf9dbe76c3e847d
SHA1

673db7eab5293911628e46ad8991e22c8663007e
SHA256

6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b
SHA512

e1f20d91d5acd65e712b1d0b3273f9dc3fe67ce113a3d8c325c907efec846b39636aa12c90f9596702a7ef269cb30c35004a03b84d5fdc1e28a9b6640abf2715
SSDEEP

1536:YExpgxDvBaKo3MQH6qpI9JkUXGdsr8SrU5ZEggyDyYzgiJ/:wV68QHRWfkEmsrxrU5ZEiuYzl/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 944 set thread context of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28
PID 944 wrote to memory of 1724	944	6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe	28

C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
"C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
  C:\Users\Admin\AppData\Local\Temp\6ce3e088ce6b660336641e6a66b7104994108a34180d70827f85b62e95c1947b.exe
  2⤵
  PID:1724

memory/1724-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-63-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1724-64-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1724-65-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download