4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbe

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 18:20

Target

4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
Size

695KB
MD5

9caffcd254391a3282cb59565c19fe06
SHA1

c87bf6c1988179062fa05833fa807b3056374c1d
SHA256

4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbe
SHA512

fcdd16c0d77aad853c58266a65c746ab095febc6154b9f07f21bf2c9dc4cb49aa674f535537eb719874ea9dc565b442327a606a4b32e0a9aa23cad75ff2c184d
SSDEEP

12288:IVi20xAn87LdAIHBmw4YmiqNKLMWozBY3DQl4:Z2gh9HBR7LMXBY3DL

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe

description	pid	process	target process
PID 2424 set thread context of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe

description	pid	process	target process
PID 2424 wrote to memory of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
PID 2424 wrote to memory of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
PID 2424 wrote to memory of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
PID 2424 wrote to memory of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
PID 2424 wrote to memory of 1100	2424	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe	4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe

C:\Users\Admin\AppData\Local\Temp\4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe
"C:\Users\Admin\AppData\Local\Temp\4afa99f3b34877cefef636c3a1f4a4360c06df2c31352a9852f30631f20e5bbeexe.exe"
2⤵
PID:1100

memory/1100-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2424-0-0x0000000000150000-0x0000000000204000-memory.dmp

Filesize
720KB

Download
memory/2424-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-2-0x0000000002210000-0x0000000002250000-memory.dmp

Filesize
256KB

Download
memory/2424-3-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2424-7-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download