3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 15:31

Target

3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe
Size

172KB
MD5

522675ce85400a4b4db93aebbeea30f8
SHA1

5e7bddfbfece7b7bed51000e6de5a0843ea5c5d2
SHA256

3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d
SHA512

19e21822a032a00733ea7c6162a52a7884cc23b3c83b7a73b2203bd9cb3fdab4714498f879774221719d045b8e8632033d30e97f09ef71bfe3b1d5bc325f566b
SSDEEP

3072:9C6e4ikK4UKgiMqQSEq0+o20Ww23enlibK:M6e4ikK4UKgiMqQSEq0+o20Ww2t

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\New Folder (2).exe	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe
File opened for modification	\??\c:\windows\New Folder (2).exe	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1692	1768	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe	27
PID 1768 wrote to memory of 1692	1768	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe	27
PID 1768 wrote to memory of 1692	1768	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe	27
PID 1768 wrote to memory of 1692	1768	3bfab5a9125634d2af06c2a0f34324f7965d2c5a38c62188e06233893d4da68d.exe	27

memory/1692-57-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download
memory/1768-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1768-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download