878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 15:16

Target

878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe
Size

364KB
MD5

294137a085e8e6996d5533564e6d92c2
SHA1

a60297ae482ec7ffb7102b5f70ae72cef888a5a8
SHA256

878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a
SHA512

ea4c5408a61c51c7c1bea882dfbb23eed38097798cebf11be25b7eb4c10ad126e112c9c1874df62cacd409d412442c47ae958aac54eab4eebb09c31d16cb7b46
SSDEEP

6144:EdiX1oA8hbwl49Il8ws6GNZcU9TIxALOg:KiXKAobwl49Il8ws6GN6eTvig

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28
PID 1280 wrote to memory of 2792	1280	878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe	28

C:\Users\Admin\AppData\Local\Temp\878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe
"C:\Users\Admin\AppData\Local\Temp\878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe
  "C:\Users\Admin\AppData\Local\Temp\878a2ca79e52c0c7fbd318da51a978f2d1574500a93f5be5f9fd835d0e04d15a.exe"
  2⤵
  PID:2792

memory/2792-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2792-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2792-7-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2792-8-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download