6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 03:34

Target

6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe
Size

349KB
MD5

a85810a9b80fe17d668259c01c1603e5
SHA1

790ddb6b381c0f7977cc9b2b3748b843232ff564
SHA256

6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef
SHA512

872aa8bd40dd466a01bf11a3fa212704de9d940da927b22865bf5b46e2dbc6370af0a06d28926faf45ab3e216cefb0e82dc3a4f27000fc675fdd296c0d0660a5
SSDEEP

6144:aCYtWRfItuEJsAoDME7EGiBeTppUYV1SWBjqvm3d3ZhZ/YBZNh3WbYFv7QQ5CF:lYtY0Py7BiBeVVNVqGdpQJhmbYFEQ5C

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 660 set thread context of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28
PID 660 wrote to memory of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28
PID 660 wrote to memory of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28
PID 660 wrote to memory of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28
PID 660 wrote to memory of 852	660	6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe	28

C:\Users\Admin\AppData\Local\Temp\6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe
"C:\Users\Admin\AppData\Local\Temp\6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:660
- C:\Users\Admin\AppData\Local\Temp\6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe
  "C:\Users\Admin\AppData\Local\Temp\6920c634a8a445c00f57c8ed411264860f0b92dd6e7c9d2c5ee8179f55bff2ef.exe"
  2⤵
  PID:852

memory/660-0-0x0000000000A20000-0x0000000000A7E000-memory.dmp

Filesize
376KB

Download
memory/660-1-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/660-2-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/660-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/660-7-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/852-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download