021add75eb8115ed09e6855a00e3aebaa0a5b519c37a5f716681e5cb79da18f1

Analysis

max time kernel
49s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/05/2023, 01:07

Target

69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
Size

777KB
MD5

16b73908872a69102b5d782b946c1c95
SHA1

a446cc9879ae237478adabad394b0317cbb2679f
SHA256

69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e
SHA512

74c1a6e7b0c8d437d52ab0f14e3a9b8998cfafee46a34c825e7bf558c9e0adfee15d3bca28529b5c45349bf31afb7b2afc980606b4d04710027757a7d0e18a5e
SSDEEP

12288:jbkcdXHwni4IyS+GgvnMLQFVvfcwr5Xi0JUCnmozOQB/Xp3I5c0x:jbJNwLwQFZfZr9jfnmozOQB/Xe5Px

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1108	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27
PID 1344 wrote to memory of 1108	1344	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	27

C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
"C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
  "C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

memory/1108-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1108-66-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1108-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1108-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1108-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1108-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1344-57-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/1344-60-0x0000000000F30000-0x0000000000F7E000-memory.dmp

Filesize
312KB

Download
memory/1344-59-0x0000000008110000-0x0000000008196000-memory.dmp

Filesize
536KB

Download
memory/1344-58-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/1344-54-0x00000000010B0000-0x0000000001178000-memory.dmp

Filesize
800KB

Download
memory/1344-56-0x0000000000950000-0x0000000000962000-memory.dmp

Filesize
72KB

Download
memory/1344-55-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download