ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 07:52

Target

ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
Size

293KB
MD5

55a3e862725bf7084a7842005d95efe1
SHA1

cb3e8098dae09136e7be98218117a8abb54f1149
SHA256

ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742
SHA512

850e0860a84e57b44e7b38ee620cd06a219ab0fe55af7abe30f748da21e611ebc0ad4767aeed7847bf297f93b9703472b77e5f13c5dac88a4f01e93260f4a778
SSDEEP

6144:Zygsngid/o7iiEavto3NTwJXm6eFBbYEHRAvpKDYiex:Zyh3o7iiYRwIRBbYQRAvMYiG

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27
PID 1448 wrote to memory of 816	1448	ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe	27

C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
"C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe
  "C:\Users\Admin\AppData\Local\Temp\ef2cf254296083b67cf44dedde5267a8692c9e433f43f495e39a245cc4c45742.exe"
  2⤵
  PID:816

memory/816-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-62-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-65-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/816-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download