fc320db42d5590a8ca9d2537e772dba6f7c355e0e676506149b79f593cf8c50f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 17:48

Target

3e9d5cad9083305171a8507acff9e06f.exe
Size

14KB
MD5

3e9d5cad9083305171a8507acff9e06f
SHA1

da34d9189db1125c51fe5a837abcda80c651bf2e
SHA256

fc320db42d5590a8ca9d2537e772dba6f7c355e0e676506149b79f593cf8c50f
SHA512

ecf928dc6364cdcad08d0849822e77843a3a0ca80059c91352be5ec50e219ebd84e5a1ed2406c781bfd9e0559689263eb5d30cde5a86efbdc460fc3a2509c4f7
SSDEEP

192:di+k3o/0qA7TBpLeP1oynacHPUWSPACmmCrQPh3ptEn75SIiMiTtVMcQ4svwv:4+k3o8tPLI1xHP/wCrQP3iNvXiBOcGv+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28
PID 1264 wrote to memory of 1040	1264	3e9d5cad9083305171a8507acff9e06f.exe	28

C:\Users\Admin\AppData\Local\Temp\3e9d5cad9083305171a8507acff9e06f.exe
"C:\Users\Admin\AppData\Local\Temp\3e9d5cad9083305171a8507acff9e06f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\3e9d5cad9083305171a8507acff9e06f.exe
  "C:\Users\Admin\AppData\Local\Temp\3e9d5cad9083305171a8507acff9e06f.exe"
  2⤵
  PID:1040

memory/1040-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1040-2-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1040-4-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1040-6-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1040-7-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download