fc7c59182246af43dd5675ac762ad50fa0ea65c6ca49e8f4b4a5a761b61c5926

Analysis

max time kernel
27s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 06:31

Target

1252-67-0x0000000000400000-0x0000000000669000-memory.exe
Size

2.4MB
MD5

95079465a646b30c5d364bc63963f5b3
SHA1

d9834d202f1387c4b7bb75067cfb020f41255fee
SHA256

fc7c59182246af43dd5675ac762ad50fa0ea65c6ca49e8f4b4a5a761b61c5926
SHA512

f17adf5fd63df50914c206f563842e7cb1198b6b41bc5f27b97c3091a33b8aa13010ba258a83573c4d5e5ca627c1143d9f0226a4f964a0386075c458a8a94a0f
SSDEEP

12288:cscRkK9uowuoyuo3f8j9ysMXFLcCjbWaOBK7Ki1nkC+lbuiNyb7OAUrfPa:mfWaOBKmi1neuiN87OAU

Score

1^/10

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2044	1028	1252-67-0x0000000000400000-0x0000000000669000-memory.exe	28
PID 1028 wrote to memory of 2044	1028	1252-67-0x0000000000400000-0x0000000000669000-memory.exe	28
PID 1028 wrote to memory of 2044	1028	1252-67-0x0000000000400000-0x0000000000669000-memory.exe	28
PID 1028 wrote to memory of 2044	1028	1252-67-0x0000000000400000-0x0000000000669000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1252-67-0x0000000000400000-0x0000000000669000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1252-67-0x0000000000400000-0x0000000000669000-memory.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2044

memory/1028-56-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download