eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/07/2023, 09:41

Target

68c43b3ca349cc9a76a0a0d52be2e53f.exe
Size

775KB
MD5

68c43b3ca349cc9a76a0a0d52be2e53f
SHA1

1dd8bb9ce6d321302cb5a5f5d83ddf9fba4a7edd
SHA256

eff9bbf602fab34b0fe063fb3595ef374fdeb30670db2eb04237a921f03ed47d
SHA512

7c774ee666d1e478874f391dc7f43f15e7c0727b656266911b004a9bcd3e682f1896d0dec2c1ca2d7cb8c791a0b692a9cf0ad512b30c266d8cff90f69ed902a6
SSDEEP

12288:r5vJRBusyg5voG1vdKx5yb1+MCyoKhnl1fRIRDmTD4BUrLUJevU:FFuMusC0eFcnlxRIlmnwevU

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2932	68c43b3ca349cc9a76a0a0d52be2e53f.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30
PID 1180 wrote to memory of 2932	1180	68c43b3ca349cc9a76a0a0d52be2e53f.exe	30

C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
"C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe
  "C:\Users\Admin\AppData\Local\Temp\68c43b3ca349cc9a76a0a0d52be2e53f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

memory/1180-68-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-61-0x0000000005E80000-0x0000000005EF4000-memory.dmp

Filesize
464KB

Download
memory/1180-56-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/1180-57-0x0000000000600000-0x0000000000614000-memory.dmp

Filesize
80KB

Download
memory/1180-58-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-59-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/1180-55-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-60-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/1180-54-0x0000000001100000-0x00000000011C8000-memory.dmp

Filesize
800KB

Download
memory/2932-64-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2932-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-67-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2932-62-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2932-69-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2932-70-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/2932-71-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download