4e8729cec052302332f77edcfed6d5c7c8856dd9574afdae822f3c66d918e261

Analysis

max time kernel
49s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15/02/2023, 15:33

Target

93ec9cf64967ae7949104a8dbfad0645.exe
Size

606KB
MD5

93ec9cf64967ae7949104a8dbfad0645
SHA1

bc87fdcf955b50d8a14ca1313ab0dc0ba4fad464
SHA256

4e8729cec052302332f77edcfed6d5c7c8856dd9574afdae822f3c66d918e261
SHA512

c73b6575b873fcad8d015f2c3648062cc7d47b05ba5f7ef32e18ff4879082557f488686037f8dfe8cb36d8230b4e34693d5df56e27b3d6127977276292a1ffc1
SSDEEP

12288:b5EoeB2gIXaqRsQI4Fvf20482V9Ty8ZQvT811+dLBuIGxaD9Fqf24Yp:+oY25lxf2047TT5Qvg4dJGxaDSe4

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1160 set thread context of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
572	93ec9cf64967ae7949104a8dbfad0645.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28
PID 1160 wrote to memory of 572	1160	93ec9cf64967ae7949104a8dbfad0645.exe	28

C:\Users\Admin\AppData\Local\Temp\93ec9cf64967ae7949104a8dbfad0645.exe
"C:\Users\Admin\AppData\Local\Temp\93ec9cf64967ae7949104a8dbfad0645.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\93ec9cf64967ae7949104a8dbfad0645.exe
  "C:\Users\Admin\AppData\Local\Temp\93ec9cf64967ae7949104a8dbfad0645.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572

memory/572-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/572-66-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Filesize
3.0MB

Download
memory/1160-54-0x0000000000EE0000-0x0000000000F7C000-memory.dmp

Filesize
624KB

Download
memory/1160-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1160-56-0x0000000000380000-0x0000000000394000-memory.dmp

Filesize
80KB

Download
memory/1160-57-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/1160-58-0x0000000005410000-0x0000000005496000-memory.dmp

Filesize
536KB

Download
memory/1160-59-0x0000000000B00000-0x0000000000B38000-memory.dmp

Filesize
224KB

Download