3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 23:14

Target

3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe
Size

325KB
MD5

91ea27fe5efc08d3b9fd34674c01075d
SHA1

a134b4f1e4229d576f3e2032b78c7fe50e142960
SHA256

3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673
SHA512

f369b7a38e535297c7d42ce3e2eba8eea94136e46db2d18793e148cd181aec383f9d86ae40659e4f174e0d2eb029cd3bb401381b6043a7928e483dec060d3f6f
SSDEEP

6144:o3AWNLMfbhVB90/6HtRESGj2GSkpGhJZ52:tQLMf9VBE6NfGmkp+Z52

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27
PID 1324 wrote to memory of 1108	1324	3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe	27

C:\Users\Admin\AppData\Local\Temp\3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe
"C:\Users\Admin\AppData\Local\Temp\3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe
  "C:\Users\Admin\AppData\Local\Temp\3048eeef10a963ed708509d5028111a8aad715d6d4650a5a1e53fa3396ff7673.exe"
  2⤵
  PID:1108

memory/1108-57-0x000000000042B055-mapping.dmp

Download
memory/1108-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1108-59-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1108-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download