2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:19

Target
2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe
Size 5.6MB
Sample240607-bpy3magb79
SHA256 2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554
MD5 8e6770d2f06f9075e1f7cc6aedfe9f8e
SHA1 522be7c6a506aa3c437eed5b3d1c41f80d58daa2
SHA512 d01ea37cccdcb637def85a572cc3568c68aad16b23b23bcd1193f1fe798c9511655e506b739e58fdd3dba1c3ea6bfdf72a7693dd87400a45f1134e6f9d0126c6
SSDEEP 49152:Sg/aL1k5sblF3buLSdGJ7xCvkuhBIydW5T56r3KrFjNYCQy+crjN5EKPB9X+hvCQ:GJVblbGhSGydgmKruWEq9di
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28
PID 3028 wrote to memory of 2620	3028	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	28

C:\Users\Admin\AppData\Local\Temp\2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe
"C:\Users\Admin\AppData\Local\Temp\2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:2620

memory/2620-6-0x00000000000F0000-0x000000000014A000-memory.dmp

Download

memory/2620-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2620-10-0x00000000000F0000-0x000000000014A000-memory.dmp

Download

memory/2620-9-0x00000000000F0000-0x000000000014A000-memory.dmp

Download

memory/2620-5-0x00000000000F0000-0x000000000014A000-memory.dmp

Download

memory/3028-2-0x000000013F100000-0x000000013F6F8000-memory.dmp

Download

memory/3028-11-0x000000013F100000-0x000000013F6F8000-memory.dmp

Download