58ca3c309de385bb0a975f4b7c9d94cb0adf6feef9c75038bc997c8b0e638465

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 16:17

Target

onecommander.exe
Size

6.5MB
MD5

55757364d854adc3fc1e5cb59532f1c3
SHA1

924b95d86b5abb136f3e6b1b2442cb9e395e8ab7
SHA256

58ca3c309de385bb0a975f4b7c9d94cb0adf6feef9c75038bc997c8b0e638465
SHA512

3096172ee8dca3b70e5f413dac4221f1ada6ac2d7d1792133744080f7f18ba84ebb8b562d60f716b51fe39f5c3d8e27985bdbcb4c025a3ed73b68261e2cec54d
SSDEEP

49152:RYY8ksnnhumByOZi/9YKpWBPA12a0rm4lKUYR+8ZduE2ak38upZjR5Es+WC7TCnN:H61BJIYKpjalKUk+8stpNEOfajHW2o

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 2068	2392	onecommander.exe	31

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31
PID 2392 wrote to memory of 2068	2392	onecommander.exe	31

C:\Users\Admin\AppData\Local\Temp\onecommander.exe
"C:\Users\Admin\AppData\Local\Temp\onecommander.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:2068

memory/2068-6-0x00000000000C0000-0x0000000000115000-memory.dmp

Filesize
340KB

Download
memory/2068-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2068-8-0x00000000000C0000-0x0000000000115000-memory.dmp

Filesize
340KB

Download
memory/2068-12-0x00000000000C0000-0x0000000000115000-memory.dmp

Filesize
340KB

Download
memory/2068-13-0x00000000000C0000-0x0000000000115000-memory.dmp

Filesize
340KB

Download
memory/2392-2-0x000000013FDF0000-0x00000001404CA000-memory.dmp

Filesize
6.9MB

Download
memory/2392-5-0x000000013FDF0000-0x00000001404CA000-memory.dmp

Filesize
6.9MB

Download
memory/2392-11-0x000000013FDF0000-0x00000001404CA000-memory.dmp

Filesize
6.9MB

Download