6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5

Analysis

max time kernel
10s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 22:43

Target

6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
Size

436KB
MD5

825e2c499a901f535d535479b44055a7
SHA1

100c38356f754c7af1bb4386b8160aebf81e0588
SHA256

6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5
SHA512

5d02b4aa421b6493210b74a28d025342950730bd42ecef671d2be5517b3fb45a64e5aaf3e97c60a2e4890634d195ee3b59e659f245edf3155702094a29dd9d6b
SSDEEP

12288:5HTMI4PwU2NMiy4POKlNVhP2YTUfq0rFvN:5zMD974mMNVhOhfqkF1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe
1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1736 wrote to memory of 1692	1736	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	28
PID 1692 wrote to memory of 1208	1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	13
PID 1692 wrote to memory of 1208	1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	13
PID 1692 wrote to memory of 1208	1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	13
PID 1692 wrote to memory of 1208	1692	6405347a9e80cfe195345ef76119fff5a20aaa4da0daa2aad1594d207430c5e5.exe	13

memory/1208-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1692-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1692-60-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1692-61-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1692-65-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1736-59-0x0000000000400000-0x00000000006CF000-memory.dmp

Filesize
2.8MB

Download