6e1000bcfd444bbb0c68302da4954c752b56e5da66fe5c9c598b62f2765295db

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 04:31

Target

5a49f5662baf895a23a8c633bd7d012f.exe
Size

22KB
MD5

5a49f5662baf895a23a8c633bd7d012f
SHA1

d001489d68cbad90783227ccf26e31fa0d3d62ce
SHA256

6e1000bcfd444bbb0c68302da4954c752b56e5da66fe5c9c598b62f2765295db
SHA512

80a6b23b13a6ccc1ba9761386417250cf661126f62d961ec98285eeb720305a9325634e3e40921699225873bcef98989c9ddb01638e6f05cd9713aca58f75c16
SSDEEP

384:M5lnZJfH5NnCd4wezxLFFUvwl57goRhdqe8h6fQYnoTwybqEImQKKXFqnP:i3fTCd4wezJP3l5Eo/dKh6VGq5LKKX

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28
PID 1072 wrote to memory of 2148	1072	5a49f5662baf895a23a8c633bd7d012f.exe	28

C:\Users\Admin\AppData\Local\Temp\5a49f5662baf895a23a8c633bd7d012f.exe
"C:\Users\Admin\AppData\Local\Temp\5a49f5662baf895a23a8c633bd7d012f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\5a49f5662baf895a23a8c633bd7d012f.exe
  "C:\Users\Admin\AppData\Local\Temp\5a49f5662baf895a23a8c633bd7d012f.exe"
  2⤵
  PID:2148

memory/2148-2-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2148-1-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2148-0-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2148-4-0x0000000013140000-0x0000000013179000-memory.dmp

Filesize
228KB

Download
memory/2148-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download