65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 02:36

Target

65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe
Size

60KB
MD5

46f5b8efaaac75304a5fac2e927dcffc
SHA1

63803d18d96881c4088a0ac93ffea1fb4e41a34c
SHA256

65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f
SHA512

98c6b403aa0b4b5e2b21381c6055cce150c20ddd78ef405e4efe898253c665317c54e89857728ec90ce85970c84de25f1a351a50df2947300d4c0c125bb47ace
SSDEEP

768:bXxOS44sR2L2Xd24dW/wFFErq94qWnFvtAFMxh4jYO5d:bP7LRKwAWrJRGh/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27
PID 1724 wrote to memory of 368	1724	65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe	27

C:\Users\Admin\AppData\Local\Temp\65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe
"C:\Users\Admin\AppData\Local\Temp\65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe
  C:\Users\Admin\AppData\Local\Temp\65615686125f0d09d1609f4b0a157895a7dc82ad401417037802f821f212330f.exe
  2⤵
  PID:368

memory/368-56-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/368-58-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/368-60-0x0000000000400200-0x0000000000400400-memory.dmp

Filesize
512B

Download
memory/368-62-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/368-63-0x0000000000400000-0x0000000000401800-memory.dmp

Filesize
6KB

Download