47cf19204ed7b766915eaabdb2182d9b202f5eda072f9139e280557adfb1e86d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:39

Target

Client/nQMailer.exe
Size

480KB
MD5

7267a267fda78ca30e36fa2bcac8ce09
SHA1

49bfcfd356b9bf716c9e77c5581cb29aac69d741
SHA256

5979d135530e3deaacfef9318a85d19a58e3a3a7010830f23ad375379d660c9b
SHA512

d3641ff8ea4737ecf0b8da1b67ed902abc539071f4649971ce3ef33d1eb538fe13051ab69e4c23f8a77fa21fca8cf8ffdf204931d267044a6f85420f2ba039c4
SSDEEP

12288:uFwm7eeXnROkg1oytE6wAnRq70xGI3a+OQSNZzSfy7xYkpdz2TGUDP3ttp6mKY:uMeJQYzjmP3tr6m

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

nQMailer.exe

description pid process target process

PID 2372 set thread context of 2192 2372 nQMailer.exe svchost.exe

description	pid	process	target process
PID 2372 set thread context of 2192	2372	nQMailer.exe	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

nQMailer.exe

description	pid	process	target process
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe
PID 2372 wrote to memory of 2192	2372	nQMailer.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
"C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2192

memory/2192-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2192-3-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2372-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2372-6-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download