ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121

Analysis

max time kernel
26s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 21:58

Target

ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
Size

252KB
MD5

81fae35e4ec59eba286ec826f8b74450
SHA1

cb7a883454fa0f9368afc237e358207a141ebbbf
SHA256

ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121
SHA512

c1bb787cb2b01f245d6b0cbc614e1a56d1a40ccfcb5c26bc505a2d3841df7970021b3e4dd0db7805ebde65f79db2cc3969a55974f511018954b0def36e4509bc
SSDEEP

3072:/NtUqoKLZSYvoFkwc5+/7VZMF7ri4kM/WiNBhu3SVIeGFwe120Q7mr4kOplM4bta:ltUs/vukw4Q7uviCWiUPqsjAm0kOBbNe

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28
PID 1676 wrote to memory of 1968	1676	ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe	28

C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
"C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
  C:\Users\Admin\AppData\Local\Temp\ac1b7ae27966c856780ca9d2ef5159f927fbc90608a041cedb6de7bbe040b121.exe
  2⤵
  PID:1968

memory/1676-54-0x00000000004B0000-0x000000000055C000-memory.dmp

Filesize
688KB

Download
memory/1676-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1676-67-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/1968-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-57-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-59-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-66-0x00000000004048EF-mapping.dmp

Download
memory/1968-69-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1968-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download