71f0abebcd6740be679092a937f3c4a886df29febc0f8ed3941b3404df0355c9

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 08:56

Target

135d9cf130dd346b9adf744c6d37469b.exe
Size

140KB
MD5

135d9cf130dd346b9adf744c6d37469b
SHA1

5fa03dd1195777609789561fec0829e4220d48d6
SHA256

71f0abebcd6740be679092a937f3c4a886df29febc0f8ed3941b3404df0355c9
SHA512

383e7795aa1009da8ef9d8370a396a8cc5ef0f0b949294f54aeeece4a922f677443d42e384d9e34a09e52a1f1866dac24cced236ee45ea55447f6d3938ad4e10
SSDEEP

3072:NGQJL20ZG009teM8XnZQLpgwWyM22/z/g21rfeEr+W7REQVH:NlV1E08AELpRWwW/5Xp7WQVH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28
PID 2988 wrote to memory of 3000	2988	135d9cf130dd346b9adf744c6d37469b.exe	28

C:\Users\Admin\AppData\Local\Temp\135d9cf130dd346b9adf744c6d37469b.exe
"C:\Users\Admin\AppData\Local\Temp\135d9cf130dd346b9adf744c6d37469b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\135d9cf130dd346b9adf744c6d37469b.exe
  "C:\Users\Admin\AppData\Local\Temp\135d9cf130dd346b9adf744c6d37469b.exe"
  2⤵
  PID:3000

memory/2988-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3000-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3000-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3000-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download