c81410938b3279f11111fdb6a5be66bf5a52a2e902ad47aa6106ce32fa893acd

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 08:01

Target

opkgdffg.exe
Size

335KB
MD5

e42d457317360c8d5308efd134d7cdd1
SHA1

873dcee67be13ddef3ed9145b6008c89b44eb4f3
SHA256

c81410938b3279f11111fdb6a5be66bf5a52a2e902ad47aa6106ce32fa893acd
SHA512

4035e3976ed3b8980473d2361acc9e1bdf514542d6d838d59b5e864a83f166c55e145a3f2504e99a3b9f8862254d40af6b6a17f2f6852eb276e8429a8d38a7a6
SSDEEP

6144:W6sAuV9qFsBDNkRvmJ6MRmAWoWQj+cFFGWeqv4iPvFTwCHxrdQ8eq844iFECA4OQ:W6BTFsBDN5J6OmxohFnXTVG8eAFE6OI

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

opkgdffg.exe

description pid process target process

PID 1212 set thread context of 1728 1212 opkgdffg.exe opkgdffg.exe

description	pid	process	target process
PID 1212 set thread context of 1728	1212	opkgdffg.exe	opkgdffg.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

opkgdffg.exe

description	pid	process	target process
PID 1212 wrote to memory of 1728	1212	opkgdffg.exe	opkgdffg.exe
PID 1212 wrote to memory of 1728	1212	opkgdffg.exe	opkgdffg.exe
PID 1212 wrote to memory of 1728	1212	opkgdffg.exe	opkgdffg.exe
PID 1212 wrote to memory of 1728	1212	opkgdffg.exe	opkgdffg.exe
PID 1212 wrote to memory of 1728	1212	opkgdffg.exe	opkgdffg.exe

C:\Users\Admin\AppData\Local\Temp\opkgdffg.exe
"C:\Users\Admin\AppData\Local\Temp\opkgdffg.exe"
2⤵
PID:1728

memory/1212-0-0x0000000000280000-0x00000000002D8000-memory.dmp

Filesize
352KB

Download
memory/1212-1-0x0000000074C30000-0x000000007531E000-memory.dmp

Filesize
6.9MB

Download
memory/1212-2-0x0000000001EB0000-0x0000000001EF0000-memory.dmp

Filesize
256KB

Download
memory/1212-3-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1212-7-0x0000000074C30000-0x000000007531E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download