0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941

Analysis

max time kernel
31s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 18:29

Target

0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe
Size

608KB
MD5

0d4a634239ff856b4a6000b9f3323ceb
SHA1

533ac35f1f7a9a4d34ef0456fba3ee1f60c05a4a
SHA256

0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941
SHA512

3dae58e373ec83f833d93a150a4e32d0752d629e93b066d0d74a54c771e2f097580fb48685c486a997f31e2416191b81f6ece0604ecc553ff15b83b851e4bf4c
SSDEEP

3072:rLtn5ymi8Eu11uZaLJbN2SQ3N7Do0JgT5SVtoaKGlD8yWC242UcdRCU4J4lg4E46:/Kucoqx

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26
PID 1460 wrote to memory of 1336	1460	0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe	26

C:\Users\Admin\AppData\Local\Temp\0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe
"C:\Users\Admin\AppData\Local\Temp\0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe
  C:\Users\Admin\AppData\Local\Temp\0cba3ccfab4709e384b1963c29f95400b2ac6fe7f218969f6bcef5ac386c4941.exe
  2⤵
  PID:1336

memory/1336-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1336-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1336-60-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1336-61-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download