6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7

Analysis

max time kernel
26s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/03/2023, 22:18

Target

6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe
Size

4.6MB
MD5

ea710d8b067b619aab99d1d6e6963cf4
SHA1

f8e9f4f1c03af1c4de7824f41560327eac848380
SHA256

6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7
SHA512

fb68ce046537a9654d1457fcebf683aa6452917b43d011970ab0e802a35fdda47a2b133900566595649ec38c40944e6421e6e6f694cc9d095921b2183f45b294
SSDEEP

98304:Gm2t3fy2VMLFDQ3lp9TgIpQ5cc+ltgm6Jfbn27nv0nm6xQPx:fb2VMQgYQ0ltgm6ZbXnmf5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28
PID 1336 wrote to memory of 868	1336	6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe	28

C:\Users\Admin\AppData\Local\Temp\6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe
"C:\Users\Admin\AppData\Local\Temp\6aa2b80ca31e8886df581d8f567bdc026242898f7cd9db2703fd6e3ef206bab7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:868

memory/868-55-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download
memory/868-56-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download
memory/868-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download