988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 16:38

Target

988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe
Size

56KB
MD5

c6433cdf79a2b573d05649c861fdce73
SHA1

a644b70df44addbc97af3ff508b197b1f2485445
SHA256

988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7
SHA512

0588890febbcf6ce1baee19ae272ce50aa6e2359dc04def5a4ba100de8f0d2bbbaf58528fce38eb81828ac064c94b7ff798cf13f3033d6cb95a45b03bd416785
SSDEEP

768:y+JS71pvXry+vvYgDGoB+Uu0jCJDKV72pa1BLcceUCSSDaXdF+lF7P7J5reaCn+v:poD2aYWvl7v3ccepSY+A37feaCMJDmS

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1332	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27
PID 1760 wrote to memory of 1332	1760	988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe	27

C:\Users\Admin\AppData\Local\Temp\988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe
"C:\Users\Admin\AppData\Local\Temp\988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe
  "C:\Users\Admin\AppData\Local\Temp\988405deb1c4436935357f0b8d691cf8e98bac3e5ebd04021cb36b521d185eb7.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1332

memory/1332-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1332-56-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1332-58-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1332-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1332-62-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1760-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1760-65-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download