4eda7c46ebe2f83e2cbc790f810351515c5b204a6cae2ea73c174afd5ab61825

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 09:17

Target

c3005965e0d208edaf9cb7c3b8be78ef.exe
Size

48KB
MD5

c3005965e0d208edaf9cb7c3b8be78ef
SHA1

c0b860ff8c0b2723a608e4009ecfb345d2afa598
SHA256

4eda7c46ebe2f83e2cbc790f810351515c5b204a6cae2ea73c174afd5ab61825
SHA512

f1df722524329a3d715302fa661fc97a6c0494ca19bd756a8c3f17132649327446e3ee4287e7a4ff0470d80639399a66875cd05a035c5357c822886b859ead04
SSDEEP

1536:OwriRego999999b6m99999DM999tZD1F753DCSkD26MvoBM:O4OD1RZCSky5oBM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1284	c3005965e0d208edaf9cb7c3b8be78ef.exe
1284	c3005965e0d208edaf9cb7c3b8be78ef.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1636 wrote to memory of 1284	1636	c3005965e0d208edaf9cb7c3b8be78ef.exe	28
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20
PID 1284 wrote to memory of 1152	1284	c3005965e0d208edaf9cb7c3b8be78ef.exe	20

memory/1152-15-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/1152-22-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1284-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1284-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-16-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1284-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1284-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1636-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1636-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download