91fde83c85a83a2ce242a1ebb819fd0eddc7291562d3cc756d64b6fd0a386b94

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 15:42

Target

file.exe
Size

330KB
MD5

cceeb294bd5e7b01e40f94616ae20df4
SHA1

6850d9bfbcc00b9cae98f197350905e3c2eca4e8
SHA256

91fde83c85a83a2ce242a1ebb819fd0eddc7291562d3cc756d64b6fd0a386b94
SHA512

121d63205c67b1bb7df41dc27169930a3f8acff7e16b1cdb39082e9d92c669348fc962b0b3d09e661c7e39f39c4a18a45db11918879f3e278d57d5774b0e4d10
SSDEEP

6144:PZY9aCa+KPVlA86o/29e3ohFFhmbcv3I+Q6rG5L/V:e9FKh6ou9wobm4v3I+Qn

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 784 set thread context of 1984 784 file.exe RegSvcs.exe

description	pid	process	target process
PID 784 set thread context of 1984	784	file.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

file.exe

description	pid	process	target process
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe
PID 784 wrote to memory of 1984	784	file.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
2⤵
PID:1984

memory/1984-55-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-57-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-54-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-60-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-62-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-59-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-65-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-63-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-64-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-66-0x000000014000356C-mapping.dmp

Download
memory/1984-68-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-69-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/1984-70-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download