ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d

Analysis

max time kernel
69s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:33

Target

ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe
Size

360KB
MD5

00e7f696d74e2c9bf43e07ba9146c000
SHA1

a18c5fb805975fcccc4f04c423fb9d26d61c4c9a
SHA256

ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d
SHA512

a40848a8aff3262fc049e407480f40f6d212efdaecf319f87d5aacb417bbbc55d63f88fa888675e0a8188a847e1f89ab545817b5f0e0c68b1822c9f65b749e71
SSDEEP

6144:ggMlsgA631zmQGk6OxASg+yHxRf1G4JaZwDaZW/Kl8aOz:IH90f1rJaZjZwKl8b

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28
PID 1636 wrote to memory of 1216	1636	ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe	28

C:\Users\Admin\AppData\Local\Temp\ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe
"C:\Users\Admin\AppData\Local\Temp\ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe
  "C:\Users\Admin\AppData\Local\Temp\ce3fbfb0c33e8ddada7ce634b2db9af9b3326ce33184d8dc91d4b30036db5c6d.exe"
  2⤵
  PID:1216

memory/1216-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1216-59-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1216-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1216-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download