47eace946134810cc13077ac11409c3c77f7c7173eb8a7f9c7278e3903a40d96

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:30

Target

34a213eb766e75d8b6a658d5e020af52.exe
Size

133KB
MD5

34a213eb766e75d8b6a658d5e020af52
SHA1

7e6c07da948125d4f0f26e8d878cfdc82a9cad63
SHA256

47eace946134810cc13077ac11409c3c77f7c7173eb8a7f9c7278e3903a40d96
SHA512

45191acc57337bc51a7f4ccbdb2548f48ac753e8e1ca9ac4aea4398e32b6fe8a91d5eae73eb4e5e27abb2aca9e92825183b6caba933bab781d14a4af232985be
SSDEEP

1536:8gzlT3EUt70xfjUJ9b5P8B7OsPGTo/SK5SB8EQWY3kf3n83obnidyqh3gZ/25:8M/6UJD8IsPGTtK5xW/nbiddJC/25

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28
PID 1572 wrote to memory of 1664	1572	34a213eb766e75d8b6a658d5e020af52.exe	28

C:\Users\Admin\AppData\Local\Temp\34a213eb766e75d8b6a658d5e020af52.exe
"C:\Users\Admin\AppData\Local\Temp\34a213eb766e75d8b6a658d5e020af52.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\34a213eb766e75d8b6a658d5e020af52.exe
  "C:\Users\Admin\AppData\Local\Temp\34a213eb766e75d8b6a658d5e020af52.exe"
  2⤵
  PID:1664

memory/1572-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1664-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1664-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download