23f9b14fb6c6a4f55b2f88bf44071c9a7f54fad8055436cd748e9bdb3b0608f1

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:05

Target

206da38006df5c053679594d73c6f62e.exe
Size

261KB
MD5

206da38006df5c053679594d73c6f62e
SHA1

dff06e0a9d21b609fb9ddec49e4358f9b9b9eef4
SHA256

23f9b14fb6c6a4f55b2f88bf44071c9a7f54fad8055436cd748e9bdb3b0608f1
SHA512

62a681c0fa28484679b1fa446e83acf23d643700a7ed39e71b48ca7ebbf3d7140d37b379b60e212e00e2d1c43737558ff510c28501b2725af2f45a4d1e85c106
SSDEEP

6144:/IKtgJMsT2mgEUGfwPBiSkj8AuKTFLE7porYTx1P+cl/2ugxjV5i:/IKZYqIS00dmsx12clWFVs

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 2948	808	206da38006df5c053679594d73c6f62e.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28
PID 808 wrote to memory of 2948	808	206da38006df5c053679594d73c6f62e.exe	28

C:\Users\Admin\AppData\Local\Temp\206da38006df5c053679594d73c6f62e.exe
"C:\Users\Admin\AppData\Local\Temp\206da38006df5c053679594d73c6f62e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\Temp\206da38006df5c053679594d73c6f62e.exe
  C:\Users\Admin\AppData\Local\Temp\206da38006df5c053679594d73c6f62e.exe
  2⤵
  PID:2948

memory/2948-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-6-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-4-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-2-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-10-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-18-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2948-22-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-13-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2948-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2948-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download