b02bc2a3fb209768e4ba648bdda0c60c223f97e9ab0003dfb09327a701bbfe30

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 22:39

Target

a085143720bf94ff257f030ab7bae1a0.exe
Size

132KB
MD5

a085143720bf94ff257f030ab7bae1a0
SHA1

0d11f398c7d9e541d36aa830ed41d9df3ac2f6bf
SHA256

b02bc2a3fb209768e4ba648bdda0c60c223f97e9ab0003dfb09327a701bbfe30
SHA512

5a36012f8c80bfc07ed738ee5b7943c6711142054e0dc896cab52df309988a77545d256dc73afc603a9633497e490326fb419e5bb9fdff0b272b841d418220b2
SSDEEP

3072:a/geW/E67ELrciHTN+Fu/Ljlc1uW3mqOANSSnf90CE:aYQ6QLdTN/LRJmmQ/f90C

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28
PID 2208 wrote to memory of 3048	2208	a085143720bf94ff257f030ab7bae1a0.exe	28

C:\Users\Admin\AppData\Local\Temp\a085143720bf94ff257f030ab7bae1a0.exe
"C:\Users\Admin\AppData\Local\Temp\a085143720bf94ff257f030ab7bae1a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\a085143720bf94ff257f030ab7bae1a0.exe
  "C:\Users\Admin\AppData\Local\Temp\a085143720bf94ff257f030ab7bae1a0.exe"
  2⤵
  PID:3048

memory/3048-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-11-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download