39a782015a3fd6125581719350115a91d3ab461772bf55cd03121dcaf22b5100

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:55

Target

271f20810b3bde2aea977e58adcf664a.exe
Size

43KB
MD5

271f20810b3bde2aea977e58adcf664a
SHA1

b190e2587997f076b58cc87da87d8c85723d50cf
SHA256

39a782015a3fd6125581719350115a91d3ab461772bf55cd03121dcaf22b5100
SHA512

d6bd0603c3afda37379cff28aa5c20a8102945b5c69a839712e0b161a157c1f95ffdce870cc81b3d3ea2f9ac4967e50b542a5cc2b234cbc5796196e981774c0b
SSDEEP

768:RJSr21Uis2hxFL07zYZuZPWVxcI77OMaF2IT9ala22MBdWjEyZpV+kjS29TbtX:R42S6wAiWVxRroT9ala22MHWjEyp+0lV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1088	271f20810b3bde2aea977e58adcf664a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28
PID 1092 wrote to memory of 1088	1092	271f20810b3bde2aea977e58adcf664a.exe	28

C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe
"C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe
  "C:\Users\Admin\AppData\Local\Temp\271f20810b3bde2aea977e58adcf664a.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1088

memory/1088-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1088-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1088-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1088-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1088-10-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1088-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1092-15-0x0000000000010000-0x0000000000022000-memory.dmp

Filesize
72KB

Download