b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 10:31

Target

b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
Size

604KB
MD5

e10fec549c39c3274dcda749ec3a7119
SHA1

467eb88366dd6778937cc682f2d0793bb8b8e4e2
SHA256

b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a
SHA512

4b383c6257569a1a8122bf0b6c82dba388a60f1238d692fbfb8239f0b6d55775b4fbb18e269f8a592d902f3c3b98f1b44a0e713c86ad298020ec326df3f2e97b
SSDEEP

12288:of1Qxpw8pplE3iifF2iRRv7lAscevzlfgzvulAvheD1P/wOwJ:Vxpw8CF7l9c25gzvulAc1/Z0

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 812 set thread context of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2504	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30
PID 812 wrote to memory of 2504	812	b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe	30

C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
"C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe
  "C:\Users\Admin\AppData\Local\Temp\b70719f9588ede8d438d20b549b4fd430c9363eea7dd42e8a15be7d2a520257a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

memory/812-8-0x00000000055A0000-0x000000000561A000-memory.dmp

Filesize
488KB

Download
memory/812-6-0x00000000006A0000-0x00000000006A8000-memory.dmp

Filesize
32KB

Download
memory/812-2-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/812-3-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/812-0-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/812-5-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/812-1-0x0000000000E40000-0x0000000000EDC000-memory.dmp

Filesize
624KB

Download
memory/812-7-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/812-4-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/812-14-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2504-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2504-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2504-13-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2504-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2504-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2504-15-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download