818ad5bddef3160906785f6cc788d06a66cec2de9f57a21a7562feb0c89334ae

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 00:08

Target

3102a215865232a5bbca8b70f1aa4488.exe
Size

4.1MB
MD5

3102a215865232a5bbca8b70f1aa4488
SHA1

b67be5b19264406c6964f5d49848b3bebb9fac72
SHA256

818ad5bddef3160906785f6cc788d06a66cec2de9f57a21a7562feb0c89334ae
SHA512

9a6dc4c1c107f9fc7527760485e1005cb4e59f0c932a9a6039ac99c93913a26cbb926da45b832554c322fb47dc5280948c3612df6fadf6ecc6c68f1f4b61ecd7
SSDEEP

24576:BLCTr7fStXHx+4e2O8vP817bBHiCIQEyLc0NShwvfbj0FoJJ5dhF2Qr3vLNHKKrS:BLCT/CXHxprYrSCHKoJJ5dhFNb0Ui7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

3102a215865232a5bbca8b70f1aa4488.exe

description pid process target process

PID 1732 set thread context of 2388 1732 3102a215865232a5bbca8b70f1aa4488.exe 3102a215865232a5bbca8b70f1aa4488.exe

description	pid	process	target process
PID 1732 set thread context of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

3102a215865232a5bbca8b70f1aa4488.exe

description	pid	process	target process
PID 1732 wrote to memory of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe
PID 1732 wrote to memory of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe
PID 1732 wrote to memory of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe
PID 1732 wrote to memory of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe
PID 1732 wrote to memory of 2388	1732	3102a215865232a5bbca8b70f1aa4488.exe	3102a215865232a5bbca8b70f1aa4488.exe

C:\Users\Admin\AppData\Local\Temp\3102a215865232a5bbca8b70f1aa4488.exe
"C:\Users\Admin\AppData\Local\Temp\3102a215865232a5bbca8b70f1aa4488.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\3102a215865232a5bbca8b70f1aa4488.exe
  "C:\Users\Admin\AppData\Local\Temp\3102a215865232a5bbca8b70f1aa4488.exe"
  2⤵
  PID:2388

memory/2388-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download