3a782bc851f1bf6cb26787ec03a15b14f99c0c4911bb6e6723d81eac386d0f24

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 11:29

Target

4e2eaed011b400990899ed03c62b71f0.exe
Size

490KB
MD5

4e2eaed011b400990899ed03c62b71f0
SHA1

b2438f79e53493a6b78a84b1f8883c1900776080
SHA256

3a782bc851f1bf6cb26787ec03a15b14f99c0c4911bb6e6723d81eac386d0f24
SHA512

2021107698fe9c590490b7c5a04a447fac273a2af43d6ec83e426b926ead5fbe58ff5fededc644b4ed2510c0bb14cba0dd2977e3a9f33f473a5dba56428a385b
SSDEEP

12288:U1FIAhwASC2AFCYG9+LbRQ+RhKr5rZnlBIC:8r2ASCt7vJQ+RhKNJlGC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28
PID 2384 wrote to memory of 1720	2384	4e2eaed011b400990899ed03c62b71f0.exe	28

C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
"C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
  C:\Users\Admin\AppData\Local\Temp\4e2eaed011b400990899ed03c62b71f0.exe
  2⤵
  PID:1720

memory/1720-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1720-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-5-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1720-7-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2384-6-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2384-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download