7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765

Analysis

max time kernel
195s
max time network
307s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 00:13

Target

7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe
Size

499KB
MD5

5161d6c2af56a358e4d00d3d50b3cafb
SHA1

0c506ae0b84539524ba32551f2f297340692c72a
SHA256

7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765
SHA512

c981aafb0e901838b1ccacda32f9b026995d5fd8cbed6590f2b3dd1178a2751065194a872c22cf24475eaf963c464916e33dd0fc620723d79b7f25d0e5041441
SSDEEP

12288:RlY3R4zdWR5YkPebLhYWT3+Kw6RDubFagn8H4:Rleqz3kW1KKlRsw

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72
PID 1716 wrote to memory of 2468	1716	7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe	72

C:\Users\Admin\AppData\Local\Temp\7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe
"C:\Users\Admin\AppData\Local\Temp\7aa5344aab15b3fb2355c59e09b7071a6a0a12ec1a5828367ecb7e9f926fe765.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2468

memory/1716-2-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1716-0-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2468-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2468-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2468-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2468-6-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download