014614e6650f00448b18b594013d532043165806280ac04e0e1aab9c9d7d8ad3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:57

Target
Client/nQMailer.exe
Size 480KB
Sample240517-ba7q8aab65
SHA256 5979d135530e3deaacfef9318a85d19a58e3a3a7010830f23ad375379d660c9b
MD5 7267a267fda78ca30e36fa2bcac8ce09
SHA1 49bfcfd356b9bf716c9e77c5581cb29aac69d741
SHA512 d3641ff8ea4737ecf0b8da1b67ed902abc539071f4649971ce3ef33d1eb538fe13051ab69e4c23f8a77fa21fca8cf8ffdf204931d267044a6f85420f2ba039c4
SSDEEP 12288:uFwm7eeXnROkg1oytE6wAnRq70xGI3a+OQSNZzSfy7xYkpdz2TGUDP3ttp6mKY:uMeJQYzjmP3tr6m
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1800	1732	nQMailer.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28
PID 1732 wrote to memory of 1800	1732	nQMailer.exe	28

C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
"C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1800

memory/1732-0-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/1732-6-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1800-3-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1800-5-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1800-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download