6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:36

Target

6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe
Size

144KB
MD5

7c334d5b1c654816549e88a2f16e6e19
SHA1

402bca982f11cd41be414ac16c152c6133832846
SHA256

6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943
SHA512

15f82d304ff0a37257a58e94ca98bbe2329018f8329708eae9728010d05def6ac2af52e4ce216c293df223e9fd012c70b22ea38d6ec2d9dea98f33e7594476af
SSDEEP

768:2tHwJRKnw/qiJm5HO7AK+QdolDVGwP/pJENjqWEURxrmC7eQvij2aQbRyflmUFP3:wHOFtIVXK+QmlHE79W22FPeOnRyxS9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 768 set thread context of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27
PID 768 wrote to memory of 916	768	6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe	27

C:\Users\Admin\AppData\Local\Temp\6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe
"C:\Users\Admin\AppData\Local\Temp\6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe
  C:\Users\Admin\AppData\Local\Temp\6738a2dba6cab1a2e6fd5829804328d6beed87da4317ac48a30e456d8bcb1943.exe
  2⤵
  PID:916

memory/916-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/916-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/916-60-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/916-61-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download