2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 01:06

Target

2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe
Size

731KB
MD5

6a0bce755ab53496fafe895f1a7dcd06
SHA1

9d0987d3c391864f971089442f206af8bdc6d050
SHA256

2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403
SHA512

031f317a35d29830a3864c2d1e413d60849111b2bdacda5e9124f03c64895f66d05cc22819876858afd01a92271ab0265b304a1336aad7b890bd2f5c6f55472b
SSDEEP

12288:iCV4x6El9voeFd4PL1H3m+Nl/SpEixrWulNXMDXPEFGotN8/xCDEmIKH:X4pL4PBH3m+f/hicuLXMr0ftYCBIK

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2764	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 1620 wrote to memory of 2764	1620	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	28
PID 2764 wrote to memory of 2700	2764	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	29
PID 2764 wrote to memory of 2700	2764	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	29
PID 2764 wrote to memory of 2700	2764	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	29
PID 2764 wrote to memory of 2700	2764	2d5daabb83d7407227101b599776df1c21b3914c6ba0fa6d0d6ee7ff7aa88403.exe	29

memory/1620-6-0x0000000004E00000-0x0000000004E8A000-memory.dmp

Filesize
552KB

Download
memory/1620-0-0x00000000741FE000-0x00000000741FF000-memory.dmp

Filesize
4KB

Download
memory/1620-2-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-3-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/1620-4-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/1620-5-0x00000000007D0000-0x00000000007E0000-memory.dmp

Filesize
64KB

Download
memory/1620-1-0x0000000000D30000-0x0000000000DEE000-memory.dmp

Filesize
760KB

Download
memory/1620-12-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2764-13-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download
memory/2764-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download