dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41

Analysis

max time kernel
72s
max time network
64s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 03:07 UTC

Target

dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe
Size

202KB
MD5

8920968df90a5745ef73108287ab3de7
SHA1

dd6e7218491c7cdcb0fb7cf41caad3ff887b973a
SHA256

dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41
SHA512

eb287fd7946d0aedc1860b7d2b16d4f23cb7efbd090243135b0003fe08350498ed4124ab44fdd5d731c879d4f613d0d8f1b007e5f5348bc1ebf9d99a5894cb23
SSDEEP

3072:vIDl7DvpS+hzqX51Y+O0PTitEV4DkrGsMSGOj7oFgHl+Q:vIDl7Dvpni5GvltEVQAG1SGuoFgHl

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28
PID 1372 wrote to memory of 960	1372	dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe	28

C:\Users\Admin\AppData\Local\Temp\dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe
"C:\Users\Admin\AppData\Local\Temp\dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe
  "C:\Users\Admin\AppData\Local\Temp\dcf4e9eed1f2ecb5ce7ca9a9899f2b991d38243b8132879de5d0819dd75f7a41.exe"
  2⤵
  PID:960

No results found

No results found

memory/960-60-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/960-62-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/960-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/960-66-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/960-68-0x0000000000403000-0x0000000000404000-memory.dmp

Filesize
4KB

Download
memory/960-69-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1372-56-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download