2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8

Analysis

max time kernel
32s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 21:47

Target

2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe
Size

141KB
MD5

070e1805e16a69850a5024e2d589e681
SHA1

1e397afc1ce0b8b4e407e4fc50cff389d6c44948
SHA256

2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8
SHA512

3ace0e31f03504f4cec809aa1a61baa6cc0027f9f0a0dfdacacfab96acd4b2a4407161fc3e5c686c7f2b50b95ddf0fe5756e4ca7b1b84be5aabe2fcfdf59c1be
SSDEEP

3072:TyaT55T0yLwLKVuW6bF3Jt/3mEDmLPiYHqYJGBWzcJvHJhP:f5T0ZOV0bo9LPzjJGBC4vD

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28
PID 1760 wrote to memory of 1900	1760	2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe	28

C:\Users\Admin\AppData\Local\Temp\2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe
"C:\Users\Admin\AppData\Local\Temp\2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe
  C:\Users\Admin\AppData\Local\Temp\2263fd66cb6481b58c45ad847869765bc8f3997535775b5a191fce259d47c3c8.exe
  2⤵
  PID:1900

memory/1244-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1760-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1760-60-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1900-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1900-61-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1900-62-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1900-66-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download