e11ae51d3cc22f4521d35a54a8cb600a31ea610fbdc55eebfee5468cb6b96d7b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:45

Target

9bf3256a9b297d0703614975674c50ac.exe
Size

476KB
MD5

9bf3256a9b297d0703614975674c50ac
SHA1

a860deadaf4f9341984068704e685409385d1b5d
SHA256

e11ae51d3cc22f4521d35a54a8cb600a31ea610fbdc55eebfee5468cb6b96d7b
SHA512

d44be39f7f33901f0295eca7b1d1dfefbb1a6bbb397aa2c531e204b46836a93260a6c15755a7f491f4fafd7c4df2e45b89c95997a987d9a6f0e5e4d77d00f31d
SSDEEP

3072:ocxXwSmJQMva8zFki2kXbcvpoADHIIsXKAQ8fWd6v8Maj+aYFtLqpuuQ0mNhU1M:0JZv5zFiIORIX8Maj+aQGuuQvNhU1M

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28
PID 1032 wrote to memory of 2328	1032	9bf3256a9b297d0703614975674c50ac.exe	28

C:\Users\Admin\AppData\Local\Temp\9bf3256a9b297d0703614975674c50ac.exe
"C:\Users\Admin\AppData\Local\Temp\9bf3256a9b297d0703614975674c50ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\9bf3256a9b297d0703614975674c50ac.exe
  "C:\Users\Admin\AppData\Local\Temp\9bf3256a9b297d0703614975674c50ac.exe"
  2⤵
  PID:2328

memory/2328-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-4-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-8-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-10-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-12-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2328-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download