9165d6fbfb3fcab53dbcc355c8c1b7bc7055ef97a9a63903fc8f23a9e994c597

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:36

Target

0350fd6111d1d5d147faee6c82d27f26.exe
Size

703KB
MD5

0350fd6111d1d5d147faee6c82d27f26
SHA1

f369925d5016393c0ffba5b9162df6d8e3673eb2
SHA256

9165d6fbfb3fcab53dbcc355c8c1b7bc7055ef97a9a63903fc8f23a9e994c597
SHA512

8f917da78cd1b0e98fad666f1c122bc67516074df79727556f4ef6cfeed0e9574d3e9700529bf956bf432b1b21652cb42556623e93c2610ac2dce762d4a87a14
SSDEEP

12288:mFdqs7u7oyOqNvRZ59ObXD446Pai7oyOqNvRZ59Ob3D446Pad1bvK+akZ8G:cqsq7HD+XDlqv7HD+3DlqMlvK+P9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28
PID 1852 wrote to memory of 1836	1852	0350fd6111d1d5d147faee6c82d27f26.exe	28

C:\Users\Admin\AppData\Local\Temp\0350fd6111d1d5d147faee6c82d27f26.exe
"C:\Users\Admin\AppData\Local\Temp\0350fd6111d1d5d147faee6c82d27f26.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\0350fd6111d1d5d147faee6c82d27f26.exe
  "C:\Users\Admin\AppData\Local\Temp\0350fd6111d1d5d147faee6c82d27f26.exe"
  2⤵
  PID:1836

memory/1836-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1836-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1836-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1852-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download