d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0

Analysis

max time kernel
142s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 21:56

Target

d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe
Size

472KB
MD5

5d7905aac5a397da8d28137c2a944886
SHA1

e3ce84b667b0853433b738f137d430531a6f7677
SHA256

d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0
SHA512

b7bc795fc94580ca4c60bd02d2304312c0e070fbc8c5fd2d2a4fc4e6bfd8fca90313676304684592fca03994a425369afdffb680c6b7784d3592b843c69a5674
SSDEEP

12288:Vy6XZwynwg1iAPd9MlbU6ex5fkw16H6Gi:Vy6XnZ7+5eDt/D

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe
980	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27
PID 2032 wrote to memory of 980	2032	d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe	27

C:\Users\Admin\AppData\Local\Temp\d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe
"C:\Users\Admin\AppData\Local\Temp\d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe
  C:\Users\Admin\AppData\Local\Temp\d3acbe43a056b08079e894ed8a5ec7dcce2dd98ef75c02250b01fabb6fd594e0.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

memory/980-63-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-69-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-56-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-58-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-59-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-61-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-70-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/980-55-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2032-67-0x00000000003C0000-0x00000000003C4000-memory.dmp

Filesize
16KB

Download
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-71-0x0000000002D10000-0x0000000002D86000-memory.dmp

Filesize
472KB

Download
memory/2032-66-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2032-72-0x0000000002D10000-0x0000000002D86000-memory.dmp

Filesize
472KB

Download