fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 19:53

Target

fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
Size

300KB
MD5

8407e9005b1ed4157b05fcdc285c1f60
SHA1

9e03ef705beeb2a0d29aee0384a5621d65b172ae
SHA256

fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c
SHA512

c04a0e6729535e6896989e79b68d52caa7b56862bf6ce86d4365422d6f28adc89a607907f39872fcab82493eab258c4c98626ec225d87f07b6bcbb5c8a26a80c
SSDEEP

6144:5z1QJ4VDOK7vn4r8nUinLlL2Oz0K7FIMweoxu10jP:5eJiNQr8nUI2O4Kzoxu1+

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27
PID 1652 wrote to memory of 1776	1652	fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe	27

C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
"C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe
  "C:\Users\Admin\AppData\Local\Temp\fb2892b345c4532c29a79b8426413b29579497dae67c3299f21937509dc05d5c.exe"
  2⤵
  PID:1776

memory/1776-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1776-57-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1776-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1776-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1776-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1776-65-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1776-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download