06fe90a9dc9849d84961c1b9973b78e8d6131bfcfe74b0d9aa140e186d121d61

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:34

Target

3b9c48b2e4434b47474d2a33cae4611a.exe
Size

187KB
MD5

3b9c48b2e4434b47474d2a33cae4611a
SHA1

50e0b1bf42272271d93ec790d9b7749c0f6f7b30
SHA256

06fe90a9dc9849d84961c1b9973b78e8d6131bfcfe74b0d9aa140e186d121d61
SHA512

a79a111e7ca9fb9914dbe85b31cac332b21c7a61d79368158e78f179787fa40f9a94ab03e3e122e76e4c122c01810fb5ff315254837b853587331d5f3bdbd54b
SSDEEP

3072:2u1maL3tP0ZVNIkNpJ2wiRdd70JlxJoazhy8Jq0G73CvQ/3F/HEOu:2u1PL3qBngwiNclYWhy8RFIvtEX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28
PID 1860 wrote to memory of 1696	1860	3b9c48b2e4434b47474d2a33cae4611a.exe	28

C:\Users\Admin\AppData\Local\Temp\3b9c48b2e4434b47474d2a33cae4611a.exe
"C:\Users\Admin\AppData\Local\Temp\3b9c48b2e4434b47474d2a33cae4611a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860
- \??\c:\users\admin\appdata\local\temp\3b9c48b2e4434b47474d2a33cae4611a.exe
  "c:\users\admin\appdata\local\temp\3b9c48b2e4434b47474d2a33cae4611a.exe"
  2⤵
  PID:1696

memory/1696-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1696-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download