e4627236e0996a44136c77798a5c41443488d99536e65a9e2c971803d5e6c73f

Analysis

max time kernel
240s
max time network
287s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:29

Target

5067c2a84b065108dcf123bbf16bff6c.exe
Size

476KB
MD5

5067c2a84b065108dcf123bbf16bff6c
SHA1

43b0f8271cf4738baa8b45190289d10bc716e055
SHA256

e4627236e0996a44136c77798a5c41443488d99536e65a9e2c971803d5e6c73f
SHA512

ecd55fe4ab36ffb87cc397519529f4f9208cad668a79df708e831f103b07b72547fe15e9bccbaab25bed748b09047abee617144c1b69c65d46c5d2b78ddc2e06
SSDEEP

6144:QyJZv5zFiIO5K9vxsJr6x7oEooLuV9u3SKk9e2dkIZFF2Ag:QcLFQ6KEHi98

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27
PID 3020 wrote to memory of 2892	3020	5067c2a84b065108dcf123bbf16bff6c.exe	27

C:\Users\Admin\AppData\Local\Temp\5067c2a84b065108dcf123bbf16bff6c.exe
"C:\Users\Admin\AppData\Local\Temp\5067c2a84b065108dcf123bbf16bff6c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\5067c2a84b065108dcf123bbf16bff6c.exe
  "C:\Users\Admin\AppData\Local\Temp\5067c2a84b065108dcf123bbf16bff6c.exe"
  2⤵
  PID:2892

memory/2892-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-8-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-10-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2892-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download