b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 04:41

Target

b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
Size

3.2MB
MD5

c351220731cb7d35f4d317c881dc33b8
SHA1

bcc87b2e47bfe4b0a7de07516c4bd1f81487393f
SHA256

b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e
SHA512

f8d26620badf8869038a7f228a24f60caca6dacf9c8ee8a230005700be5682167db021e7a16326b0ecee8673d364b006118e38663ea153fc19effcefb42ba40a
SSDEEP

98304:UIZbv/uBySU1HhAp7r+X5t0dVBTktDUAFkzuug2:UgXc+30dXkt+z7

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2980 set thread context of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28
PID 2980 wrote to memory of 2952	2980	b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe	28

C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
"C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe
  "C:\Users\Admin\AppData\Local\Temp\b2342ad096728fbc2444464763b2d4f895183a4df54ee208776571483e78892e.exe"
  2⤵
  PID:2952

memory/2952-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2952-5-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/2952-8-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/2952-9-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/2952-10-0x0000000000400000-0x0000000000B66000-memory.dmp

Filesize
7.4MB

Download
memory/2980-0-0x0000000004910000-0x0000000004C15000-memory.dmp

Filesize
3.0MB

Download
memory/2980-1-0x0000000004910000-0x0000000004C15000-memory.dmp

Filesize
3.0MB

Download
memory/2980-3-0x0000000004C20000-0x000000000534E000-memory.dmp

Filesize
7.2MB

Download
memory/2980-7-0x0000000004910000-0x0000000004C15000-memory.dmp

Filesize
3.0MB

Download