46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 16:18

Target

46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe
Size

3.9MB
MD5

f5d638d288f869feddac07e7ecf37cc7
SHA1

bb2dde86cd35cd4758ef1e6d7d45d720a0282623
SHA256

46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1
SHA512

1939cec202b110e2cac4565d6ab56baa1ca08f74010cdaf8042228c3f947db3a5f2c2ec91527770cb15a6e85a6ea6cfcebb23c879c3378b925f5cbe68ef53b6a
SSDEEP

24576:Iw6ZzypBX3gahprwMtcjt/CSiVJFEQSDPFJuaZLCIcy79qWaxg:Iwazs3gahprwMedqe8I1L

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3068	䵂婂䙘X

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30
PID 1484 wrote to memory of 3068	1484	46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe	30

C:\Users\Admin\AppData\Local\Temp\46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe
"C:\Users\Admin\AppData\Local\Temp\46ad957e8c54b22da62d658d4dfabe42e2a5eec71e8b354d1b53f366c6e3e1a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\䵂婂䙘X
  "C:\Users\Admin\AppData\Local\Temp\䵂婂䙘X"
  2⤵
  - Executes dropped EXE
  PID:3068

C:\Users\Admin\AppData\Local\Temp\䵂婂䙘X

Filesize
38KB

MD5
3992f464696b0eeff236aef93b1fdbd5

SHA1
8dddabaea6b342efc4f5b244420a0af055ae691e

SHA256
0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

SHA512
27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

Download Submit
memory/1484-0-0x000000013FA90000-0x000000013FF72000-memory.dmp

Filesize
4.9MB

Download
memory/1484-17-0x000000013FA90000-0x000000013FF72000-memory.dmp

Filesize
4.9MB

Download
memory/3068-6-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-9-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-10-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-8-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-16-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3068-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download