c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf

Analysis

max time kernel
3s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:40

Target

c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe
Size

107KB
MD5

9107d779989e4d98f7649a2a193d87cc
SHA1

92bc3da7f3e657c078754136afc4a4a3f443d0ad
SHA256

c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf
SHA512

d7ff1b30976e1ba8d4cfd6eab378f9670864e95da218bb413fd08187de1a7da296d15ababc84e0e7e494bac4c5a6f17359132ff68014d87e83974d3bf593543d
SSDEEP

1536:U9vAHxK9lyX4r26q3tkf8mPZePKKTsvkBqJnq2nKHk5m2uqFCj:UOQ9lb7q3SfwPKK484JqQik5NuqFe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1864	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 920 wrote to memory of 1864	920	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	27
PID 1864 wrote to memory of 1208	1864	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	15
PID 1864 wrote to memory of 1208	1864	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	15
PID 1864 wrote to memory of 1208	1864	c21099596d9485ae2739ebca04d8a93e90a4ac33b5fbda95cd1e58a543ac21bf.exe	15

memory/920-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/920-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/920-56-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/920-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1864-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1864-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1864-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download