5ab4d57b67c50320041be5336493fba616edba112f13ba0d02fcdde81568ecd5

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17/02/2023, 01:31

Target

adb82ddb28c4b844368071567043c607.exe
Size

105KB
MD5

adb82ddb28c4b844368071567043c607
SHA1

07d56a83700924a1363a9ee8ffbad097a9b2f62b
SHA256

5ab4d57b67c50320041be5336493fba616edba112f13ba0d02fcdde81568ecd5
SHA512

bcfe91016e405ef3cf072b2f42568b25f9a2a26a5f1bcb860017bfbcfb2b2e9d2bc4d6394ead493f6d10a44f610dc167e6afdbada114ae1f70c7bdaf255e6e64
SSDEEP

1536:MfTv7XcqRNPh9lNlX36IogTpcC9TPRVq4JM1Wfhfy46bDVZhFpyRFDulQhcp:MfTv7X1Ph971KIomPW8pfy5bvp+q

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 900	1808	adb82ddb28c4b844368071567043c607.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28
PID 1808 wrote to memory of 900	1808	adb82ddb28c4b844368071567043c607.exe	28

C:\Users\Admin\AppData\Local\Temp\adb82ddb28c4b844368071567043c607.exe
"C:\Users\Admin\AppData\Local\Temp\adb82ddb28c4b844368071567043c607.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:900

memory/900-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/900-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/900-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/900-64-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download