1ac73f707a2c04f591bab7f5bcb364899c408354b2d4742a71a332ed1ecf5fef

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 02:41

Target

506c9a506374c5962bbc5011ff837f479f0782ec.exe
Size

136KB
MD5

63c77d07c095de19e059c41c52895522
SHA1

506c9a506374c5962bbc5011ff837f479f0782ec
SHA256

1ac73f707a2c04f591bab7f5bcb364899c408354b2d4742a71a332ed1ecf5fef
SHA512

7c211f1ca7e32b81cd0f42e3a42934b3fb2262987eb640a30d65c070e53c488a94fc282f9667dcb2b2548e2f77814b13d8c7157367bd731082f5fa35270acf11
SSDEEP

3072:6dDsmW3J31B7lrtZQO/Bh89R7vmHMM5HGEs:YgvB7lh20HMRXoGEs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1476 set thread context of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1392	506c9a506374c5962bbc5011ff837f479f0782ec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1476 wrote to memory of 1392	1476	506c9a506374c5962bbc5011ff837f479f0782ec.exe	27
PID 1392 wrote to memory of 1380	1392	506c9a506374c5962bbc5011ff837f479f0782ec.exe	15
PID 1392 wrote to memory of 1380	1392	506c9a506374c5962bbc5011ff837f479f0782ec.exe	15
PID 1392 wrote to memory of 1380	1392	506c9a506374c5962bbc5011ff837f479f0782ec.exe	15

memory/1392-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1392-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1392-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1392-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1476-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1476-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1476-56-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1476-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1476-61-0x0000000001C80000-0x0000000001CAC000-memory.dmp

Filesize
176KB

Download