2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 18:12

Target

2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe
Size

732KB
MD5

9ac6d0c9e29cf030a96f2693464a7a05
SHA1

115d08dc49b117554e8dba99fa0dce68751445d8
SHA256

2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2
SHA512

1c985cf32439cc7714f0672826ce916e3d0441a5a5af1eda6124aa4323232da484fd1a1491ced99bcebe4710ce31a5d56f32b4ad79aa5afcdb2b450bea3d9d60
SSDEEP

12288:XPO2JLfYry+0NZfGxO/49wSreaPTBGJBlgkj4u4emzw2qKeW1f7gbeQ:mwl+0NZAO/49w/k9GdrjtXcPq3Wu

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2960	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2960	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 1924 wrote to memory of 2960	1924	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	28
PID 2960 wrote to memory of 2980	2960	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	29
PID 2960 wrote to memory of 2980	2960	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	29
PID 2960 wrote to memory of 2980	2960	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	29
PID 2960 wrote to memory of 2980	2960	2ec8179daac23d3f433702623eb9b216057e114480b271a6225f228c51bee0d2.exe	29

memory/1924-12-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-1-0x0000000001020000-0x00000000010DA000-memory.dmp

Filesize
744KB

Download
memory/1924-2-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-3-0x00000000005A0000-0x00000000005B8000-memory.dmp

Filesize
96KB

Download
memory/1924-4-0x0000000000480000-0x0000000000490000-memory.dmp

Filesize
64KB

Download
memory/1924-5-0x0000000005D80000-0x0000000005E0A000-memory.dmp

Filesize
552KB

Download
memory/1924-0-0x000000007446E000-0x000000007446F000-memory.dmp

Filesize
4KB

Download
memory/2960-10-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2960-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2960-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2960-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2960-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-13-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download
memory/2960-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download