9faa76e174866b44c256af8c9d2bc0c09f56b3a04ea1a0beda8ffdd6b551b343

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 19:55

Target

â¶ï¸Sex Camers_8097.exe
Size

1.4MB
MD5

a119b9b350cdd2382ecc4914d081eda1
SHA1

ac98b5b36d997874bdfcbaa2dd90022849d5a894
SHA256

b7419ea76f2a01b4b73f92b7cc78bf1b5bcba0195ac08d610aafe87898032307
SHA512

1a7d6355f038b2d1692d64756241aa19c92b83ed0cd45f892dbd2465a8c878de8af6b7748d661151305876f775aab9031065a95cf99e3c420c62da3d8cce3242
SSDEEP

6144:C9t/c6VE7ZNAWlhVeOsi/yAOeAsGSmhl8f:mBc6VE7ZGCdyAwhlq

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2980	3048	â¶ï¸Sex Camers_8097.exe	29

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29
PID 3048 wrote to memory of 2980	3048	â¶ï¸Sex Camers_8097.exe	29

C:\Users\Admin\AppData\Local\Temp\â¶ï¸Sex Camers_8097.exe
"C:\Users\Admin\AppData\Local\Temp\â¶ï¸Sex Camers_8097.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2980

memory/2980-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-64-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2980-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-67-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2980-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2980-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download