b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12

Analysis

max time kernel
35s
max time network
84s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 03:19

Target

b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe
Size

146KB
MD5

5aeac4f3515f40d877312fb46f71d763
SHA1

6601ef966b90ead0c651dc45deee6448545db67c
SHA256

b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12
SHA512

952907b24cdcf56fa9e86a74f1e8bbd6d56f2b37afd70bbb3e5ee217ddeec36b064a733fb049a5eb0e34f5499bc644198fa78112e535ef8e15ae8ad1011467b2
SSDEEP

3072:1YlzW5vdXpKybT1hUisIvGzFGeEpOpoFu3rI3UHUEHvU7pI2e+Tb:1YhwvdX7xhFROzF1EwpiorI3UHa9BeQ

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe
1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27
PID 1556 wrote to memory of 1728	1556	b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe	27

C:\Users\Admin\AppData\Local\Temp\b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe
"C:\Users\Admin\AppData\Local\Temp\b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe
  C:\Users\Admin\AppData\Local\Temp\b09df993fa2319cccfcb74a48b6c02fa3e96a27bfa56bbafb474f55f9a8c8c12.exe
  2⤵
  PID:1728

memory/1556-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1556-61-0x00000000002F0000-0x00000000002F4000-memory.dmp

Filesize
16KB

Download
memory/1728-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1728-57-0x0000000000400000-0x0000000005608000-memory.dmp

Filesize
82.0MB

Download
memory/1728-58-0x0000000000400000-0x0000000005608000-memory.dmp

Filesize
82.0MB

Download
memory/1728-60-0x0000000000400000-0x0000000005608000-memory.dmp

Filesize
82.0MB

Download
memory/1728-62-0x0000000000400000-0x0000000005608000-memory.dmp

Filesize
82.0MB

Download
memory/1728-63-0x0000000000400000-0x0000000005608000-memory.dmp

Filesize
82.0MB

Download
memory/1728-66-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1728-68-0x0000000000020000-0x0000000000027000-memory.dmp

Filesize
28KB

Download